Linux Kernel posix-cpu-timers Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's handling of POSIX CPU timers. This issue arises when a non-leader thread executes 'execve', causing a PID switch with the leader process. As the thread calls 'exit_itimers', the timer management function 'posix_cpu_timer_del' fails to locate the task because the timer references the old PID. Consequently, active timers remain armed and are not disarmed, leading to a memory management issue. Although 'exit_itimers' releases the associated memory, the retained timers can cause a use-after-free condition when the timer queue is processed.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, which can potentially be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.