Linux Kernel Vulnerability Affecting Sparc64 Systems

CVE-2026-89765

What is CVE-2026-89765?

A vulnerability exists in the Linux kernel's handling of the itimerval structure on native Sparc64 systems. An issue arises due to a four-byte hole in the struct __kernel_old_timeval, where the 64-bit tv_sec field is followed by a 32-bit __kernel_suseconds_t field. The improper initialization of this structure can lead to unintended data exposure when using the getitimer() function. By not zero-initializing the aggregate before copying it to user space, the implicit padding can reflect unpredictable values, highlighting the importance of secure data handling across user/kernel boundaries.

References