CVE-2026-72068

A low-impact integer truncation flaw was found in the Linux kernel's posix-cpu-timers subsystem, affecting Red Hat Enterprise Linux and Red Hat In-Vehicle OS only on 32-bit architectures. In update_rlimit_cpu(), the RLIMIT_CPU soft limit is converted to nanoseconds with a 32-bit multiplication that truncates the result for limits greater than 4 seconds. The truncated value is installed in the CPUCLOCK_PROF expiry cache, so the process CPU timer is programmed to fire prematurely for RLIMIT_CPU soft limits of 5 seconds or more, causing premature delivery of SIGXCPU/SIGKILL and a limited denial of service against affected processes. The actual limit enforcement decision in check_process_timers() already uses 64-bit arithmetic and remains correct, so the CPU limit is not bypassed; exploitation requires a local process to set its own RLIMIT_CPU, and 64-bit kernels are unaffected. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. For affected Red Hat Enterprise Linux 8, 9, and 10 update streams and Red Hat In-Vehicle OS streams, the fix is deferred because the impact is low and resource limit enforcement remains correct; the residual risk is limited to premature CPU timer signal delivery on 32-bit systems. Red Hat rates the impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 suggests Moderate, because the flaw only degrades CPU timer expiry-cache accuracy on 32-bit systems and does not weaken actual resource limit enforcement or affect confidentiality or integrity.