---
id: CVE-2026-89765
title: 'timers/itimer: Zero-init old itimerval before copy to userspace'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  timers/itimer: Zero-init old itimerval before copy to userspace

  On native sparc64, struct __kernel_old_timeval contains a four-byte hole
  after tv_usec because tv_sec i…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-201
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6d4b937251386d9c6f968e7802f0cb16a8523772
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    4ea70146ab9376092297eb8b622ef1792797f2cf
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a17b345daff46fec4af9f1ecbdf350208016dd15
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    bdfda99c5763822a9a888e8af0ad7d9312ffcfe2
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    00ef529a5402f41eb1d227916437e237450719f9
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8
  - Linux 2.6.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:52:18.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89765'
references:
  - url: 'https://git.kernel.org/stable/c/6d4b937251386d9c6f968e7802f0cb16a8523772'
  - url: 'https://git.kernel.org/stable/c/4ea70146ab9376092297eb8b622ef1792797f2cf'
  - url: 'https://git.kernel.org/stable/c/a17b345daff46fec4af9f1ecbdf350208016dd15'
  - url: 'https://git.kernel.org/stable/c/bdfda99c5763822a9a888e8af0ad7d9312ffcfe2'
  - url: 'https://git.kernel.org/stable/c/4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4'
  - url: 'https://git.kernel.org/stable/c/2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e'
  - url: 'https://git.kernel.org/stable/c/00ef529a5402f41eb1d227916437e237450719f9'
  - url: 'https://git.kernel.org/stable/c/18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89765.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89765'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532295'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89765'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89765'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89765.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00201
epssPercentile: 0.09968
ingestedAt: '2026-09-14T15:23:07.448Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

timers/itimer: Zero-init old itimerval before copy to userspace

On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.

Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6d4b937251386d9c6f968e7802f0cb16a8523772`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4ea70146ab9376092297eb8b622ef1792797f2cf`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a17b345daff46fec4af9f1ecbdf350208016dd15`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bdfda99c5763822a9a888e8af0ad7d9312ffcfe2`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 00ef529a5402f41eb1d227916437e237450719f9`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89765.json)