Linux Kernel Pushes Six Coordinated Stable Releases to Fix 16-Year-Old POSIX Timer Race
Every currently-supported longterm branch gets the same use-after-free patch from Thomas Gleixner.
Greg Kroah-Hartman dropped a coordinated set of six Linux kernel stable releases this past Thursday, and every single one of them centers on the exact same critical patch. The longterm branches affected are 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, and 6.18.41. You are looking at the entire supported kernel tree right now.
The headline fix targets a use-after-free vulnerability in the POSIX CPU timers subsystem. A race condition between sys_timer_delete() and a non-leader thread calling exec() trips it. The result is freed memory getting accessed by subsequent timer operations. Timers can also silently stop firing. Worse than a clean crash in some cases if you are running daemons that rely on precise tick counts.
Thomas Gleixner authored the patch. It is a four-part solution that adds release semantics to signal handler locks, inserts a matching acquire barrier, and builds a new retry-based lookup helper that actually catches the thread switch after an exec completes. The bug itself has been lurking since the early days of the kernel. A 2010 workaround hid the real issue, and when kernel developers swapped to a pid-based tracking system a few years back, they accidentally reopened the door.
How the Race Actually Unfolds
Independent researchers Wongi Lee and Jungwoo Lee uncovered the race through what sounds like serious fuzzing or manual code archaeology. They spotted that when sys_timer_delete() observes the old leader, it can free a timer object that a simultaneously executing non-leader thread still holds a reference to. The queue node stays dangling. Any subsequent add or delete operations on other timers in that same signal structure will walk over freed memory.
The kernel's POSIX timer code is one of those subsystems that looks completely fine on the surface until you start threading things together and calling exec() from the wrong place. A clean fix, but the fact that it spans all six branches at once is the real story here. You would think a race this elegant in its destruction would have been caught earlier, but concurrent systems are weird like that. The only branch getting an extra patch is 6.18.41, which picks up a preparatory commit from April that lets timer callbacks return a boolean for better state tracking.
If you are running any of these kernels on production systems with multi-threaded daemons or container runtimes doing heavy exec() work, getting the update is probably worth the reboot. The ChangeLog files only list the upstream backports, but each stable tree also includes dozens to hundreds of branch-specific driver and subsystem fixes that are not publicly summarized in the release notes.
Linux kernel 5.10.262 released
Linux kernel version 5.10.262 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.262.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.10.262.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.262.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.10.262/v5.10.261
Linux kernel 5.15.213 released
Linux kernel version 5.15.213 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.213.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.15.213.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.213.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.15.213/v5.15.212
Linux kernel 6.1.180 released
Linux kernel version 6.1.180 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.180.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.1.180.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.180.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.1.180/v6.1.179
Linux kernel 6.6.147 released
Linux kernel version 6.6.147 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.147.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.6.147.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.147.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.6.147/v6.6.146
Linux kernel 6.12.100 released
Linux kernel version 6.12.100 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.100.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.12.100.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.100.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.12.100/v6.12.99
Linux kernel 6.18.41 released
Linux kernel version 6.18.41 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.41.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.18.41.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.41.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.18.41/v6.18.40
