Kernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsLockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsA 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsA preemptible window let concurrent tasks inflate callchain length and overwrite caller buffers via bpf_get_stack and bpf_get_stackid.
By oops