CVE-2026-93146

What it actually does

Missing validation of the tv_nsec field in proc_timens_set_offset allows non-normalized values (negative or >= NSEC_PER_SEC) to reach timespec64_add, producing incorrect or undefined time calculations inside the kernel.

Why it matters to the business

Containerized workloads or processes using time namespaces may experience unexpected time drift, scheduling anomalies, or instability; current low exploit probability and absence from known exploited lists reduce immediate operational urgency but still require patching within normal kernel update cycles.

How an attack unfolds

An attacker with write access to a process's timens_offsets procfs entry supplies an offset whose tv_nsec component is outside the valid range; when the kernel later performs timespec64_add the resulting unnormalized value leads to incorrect time offsets or kernel misbehavior.

How to fix it

Apply the upstream kernel commit that adds explicit validation ensuring tv_nsec lies within [0, NSEC_PER_SEC-1] before calling timespec64_add; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Inspect the proc_timens_set_offset function in the running kernel source or binary to confirm the added range check on tv_nsec; attempt to set an offset with tv_nsec >= 1000000000 and verify the write is now rejected.

Typical attack path

1. Locate a process whose time namespace can be influenced via procfs
2. Write a crafted offset containing an out-of-range tv_nsec value to /proc/<pid>/timens_offsets
3. Trigger subsequent time-related syscalls or namespace operations that invoke timespec64_add
4. Observe resulting incorrect time calculations or system instability

How to detect it

Review audit logs or eBPF traces for writes to timens_offsets procfs paths; correlate any such writes with subsequent anomalous time or scheduling events in affected processes.

What your security team should do

• Include the fix in the next scheduled kernel update cycle given the 37-day publication window and stable low EPSS
• Restrict unprivileged write access to timens_offsets entries via mount options or LSM policy
• Monitor upstream stable and distribution kernel changelogs for backports