CVE-2026-72068

A flaw was found in the Linux kernel's posix-cpu-timers component on 32-bit systems. An integer truncation vulnerability occurs in the update_rlimit_cpu() function when converting the RLIMIT_CPU value to nanoseconds. This issue causes the process CPU timer to be programmed to fire prematurely for RLIMIT_CPU soft limits of 5 seconds or more. While actual resource limit enforcement remains correct, this premature timer expiry could lead to a denial of service for affected processes.

A low-impact integer truncation flaw was found in the Linux kernel's posix-cpu-timers subsystem, affecting Red Hat Enterprise Linux and Red Hat In-Vehicle OS only on 32-bit architectures. In update_rlimit_cpu(), the RLIMIT_CPU soft limit is converted to nanoseconds with a 32-bit multiplication that truncates the result for limits greater than 4 seconds. The truncated value is installed in the CPUCLOCK_PROF expiry cache, so the process CPU timer is programmed to fire prematurely for RLIMIT_CPU soft limits of 5 seconds or more, causing premature delivery of SIGXCPU/SIGKILL and a limited denial of service against affected processes. The actual limit enforcement decision in check_process_timers() already uses 64-bit arithmetic and remains correct, so the CPU limit is not bypassed; exploitation requires a local process to set its own RLIMIT_CPU, and 64-bit kernels are unaffected. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. For affected Red Hat Enterprise Linux 8, 9, and 10 update streams and Red Hat In-Vehicle OS streams, the fix is deferred because the impact is low and resource limit enforcement remains correct; the residual risk is limited to premature CPU timer signal delivery on 32-bit systems. Red Hat rates the impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 suggests Moderate, because the flaw only degrades CPU timer expiry-cache accuracy on 32-bit systems and does not weaken actual resource limit enforcement or affect confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.