CVE-2026-72068

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with

u64 nsecs = rlim_new * NSEC_PER_SEC;

On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC

(1000000000L) are 32-bit, so the multiplication is performed in unsigned

long and truncated for rlim_new > 4 seconds before being widened to u64.

The same file already casts to u64 for the matching computation in

check_process_timers():

u64 softns = (u64)soft * NSEC_PER_SEC;

As a result, the truncated value is installed into the CPUCLOCK_PROF

expiry cache (nextevt), causing the process CPU timer to be programmed

to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The

actual SIGXCPU/SIGKILL decision in check_process_timers() already casts

to u64 and is therefore correct, so limit enforcement is not broken;

only the expiry-cache programming is wrong. Appl

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References