A process timer could remain queued after its backing object was freed

Summary

Linux process CPU timers are shared across a thread group. If a non-leader thread calls exec(), it can replace the old group leader while another thread is trying to delete one of those timers.

Before the fix, that race could free an armed struct k_itimer even though its embedded timer node was still linked in the process timerqueue. A later timer operation would then access the freed object.

Why it mattered

The race uses ordinary timer, threading, and execve() system calls available to a local unprivileged process. The attacker controls both sides and can retry it, turning a stale timerqueue node into kernel memory corruption rather than relying on another user’s action.

CyberMeowfia validates the issue as a local privilege escalation on a Pixel 10 Pro running the July 2026 Android 17 build. On that exact target, the published exploit disables SELinux and obtains a root shell; the repository reports a success rate above 50%.

The issue has been fixed. Updated vendor kernels containing the relevant backport are not affected merely because their displayed base kernel version falls within an older branch.

What went wrong

posix_cpu_timer_del() could look up the old thread-group leader just as de_thread() replaced it during a non-leader exec(). When the old leader’s sighand became NULL, the timer deletion path could return without unlinking an armed timer and then free the underlying k_itimer.

The timerqueue still held the freed object’s node. Later expiry, insertion, or deletion work followed that dangling node, producing a use-after-free. A related path affected CPU nanosleep timers allocated on a kernel stack.

Exploit

Because the vulnerability and its fix are public, the selected exploit source is included here for reproducibility. The preview starts at main() and shows exactly 15 lines. Expanding it reveals the complete C file embedded in this page; the build instructions remain in the linked CyberMeowfia directory.

4962
int main(int argc, char **argv) {
4963
    unsigned char fake_fragment[ORDER1_SIZE] __attribute__((aligned(0x1000)));
4964
    struct sigaction ignore;
4965
    char baseline[64];
4966
    uint64_t baseline0;
4967
    uint64_t baseline1;
4968
    struct watcher_result stage0_result;
4969
    struct watcher_result marker_result;
4970
    struct controlled_page page;
4971
    struct pipe_reclaim_probe pipe_probe;
4972
    struct stat uhid_stat = {0};
4973
    int stage0_pass = 0;
4974
    int attempt;
4975

4976
    if (argc > 1 && !strcmp(argv[1], "--exec-child")) {

Patch

The upstream correction adds the memory ordering needed when sighand becomes NULL and retries task lookup across a thread-group leader replacement. The affected timer operations therefore find the new leader or safely conclude that the task is gone instead of freeing a timer which remains queued.

Install an Android or Linux kernel update containing the applicable stable backport. Confirm through the vendor’s changelog or CVE notice rather than comparing only the visible kernel version.