CVE-2026-64560: Linux Kernel CPU Timer Use-After-Free Gives a Root Shell, PoC Exploit Code Publicly Disclosed

TL;DR

A Linux kernel CPU timer flaw lets a local user reach root. Tracked as CVE-2026-64560, it scores 7.0 on CVSS. Researchers confirmed a root shell on a Pixel 10 Pro. The full details and proof-of-concept exploit code are now public.

Why it matters

CPU timers are a core part of the Linux kernel. So the bug reaches well beyond a single device. On the tested Pixel, the exploit even disabled SELinux. Public exploit code makes patching urgent.

How the attack works

The flaw is a use-after-free triggered by a race condition. It happens between a POSIX process CPU timer deletion and a non-leader exec(). Timing decides the outcome.

The kernel can free an armed timer structure while its node is still linked in the process timer queue. Later timer-queue operations then touch freed memory. This Linux kernel CPU timer flaw turns that race into a path to root.

The researchers reported a success rate above 50 percent. Their binary runs directly to gain a shell. This report withholds working payloads and steps.

Public disclosure and exploit code

Full technical details and proof-of-concept code sit in a public CVE-2026-64560 research repository. This public release raises the pressure to update quickly.

Exploitation status

Public proof-of-concept exploit code exists for CVE-2026-64560. However, no in-the-wild exploitation has been confirmed at this time.

Affected versions

The flaw affects Linux kernels before the upstream fix. Researchers confirmed it on a Pixel 10 Pro running kernel 6.6.118, using the July 05 release build.

Patch and mitigation

The issue was fixed upstream in the kernel. Apply the latest kernel and Android security updates as soon as they reach your device.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.