In the Linux kernel, a reference count leak was discovered in the posix_cpu_timer_create path used by the do_cpu_nanosleep() function. When posix_cpu_timer_set fails, the code fails to release the PID reference that was obtained via get_pid(), causing the reference count to remain incremented. This leak can accumulate over time, leading to increased memory consumption and potentially exhausting kernel resources. The vulnerability does not grant immediate control of arbitrary code but offers a low‑impact denial of service path by degrading system stability through refcount accumulation.

All Linux kernel installations prior to the inclusion of the fix – specifically kernel versions containing the posix_cpu_timer_create and do_cpu_nanosleep functions – are affected. The vulnerability applies to the standard Linux kernel as distributed by the Linux Kernel Community. No specific vendor versions are listed, so any deployment of a pre‑patched kernel must be considered at risk.

The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at the time of this analysis. The vulnerability is not referenced in CISA’s KEV catalog, suggesting no publicly known exploits. An attacker would need to invoke the posix CPU timer API from user space and force an error in posix_cpu_timer_set to exercise the leak; thus the attack vector is local control of a process with the capability to create CPU timers, inferred from the need to invoke the API from user space. Because the leak is silent, detection requires monitoring of PID reference counts or observing gradual resource exhaustion.