CVE-2017-5967: The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local user...

Security readout for executives and security teams

This is a Linux kernel information disclosure issue. On affected builds, a local user may learn host-level process IDs even when PID namespaces should hide them. That weakens isolation, especially on shared or containerized systems, but the source bundle does not indicate remote compromise or code execution. Exposure is most likely on older Linux systems through 4.9.9 that enabled CONFIG_TIMER_STATS and permit local users to read /proc/timer_list. Shared hosting, multi-user servers, and container hosts have higher relevance than single-user systems. Treat this as a low-priority legacy kernel hardening issue unless affected systems host untrusted local users or containers. Patch during normal maintenance, with faster handling for shared infrastructure where PID namespace isolation matters. Mitigation focus: Check vendor kernel advisories and apply kernel updates containing the upstream correction.; Verify whether CONFIG_TIMER_STATS is enabled on legacy kernel builds.; Reduce local untrusted user access on affected systems until patched..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.