The Linux kernel code that translates a user‑supplied RLIMIT_CPU soft limit into nanoseconds uses unsigned 32‑bit arithmetic on 32‑bit kernels. When the limit is five seconds or greater, the multiplication by one billion overflows and the value is silently truncated before it is widened to 64 bits. The truncated result is written into the CPUCLOCK_PROF expiry cache, so the timer programmed to deliver a SIGXCPU is set too early. The enforcement logic that actually decides to send a signal performs a correct 64‑bit multiplication, so the limit remains correctly enforced, but the timer pre‑fires, causing the target process to terminate sooner than intended. The flaw does not alter the signal decision or provide any form of additional access or data breach.

All 32‑bit Linux kernel installations are affected, regardless of distribution or upstream source. 64‑bit kernels do not exhibit the overflow, and non‑Linux operating systems are unaffected.

The vulnerability lacks a remote exploitation vector and only impacts locally running processes with a soft RLIMIT_CPU limit of five seconds or more. The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, indicating a low probability of exploitation and limited scope. A local user capable of creating or modifying a process could observe premature termination, but the defect does not grant privilege escalation, data exfiltration, or wider system compromise.