CVE-2026-89765

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description On native sparc64, the kernel old timeval structure contains a four-byte hole after tv usec because tv sec is 64-bit while kernel suseconds t is 32-bit. The put itimerval() function fills only the named fields in a stack-allocated kernel old itimerval and copies the entire object to userspace. Consequently, the getitimer() function can expose two padding holes, potentially leaking uninitialized kernel stack memory to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.