The Linux 7.2 kernel is set to receive important security enhancements for its timer subsystem, aimed at thwarting a specific class of Denial-of-Service (DoS) attack that exploits invalid timer requests.
The core improvement adds a validation check within the kernel's timer machinery. Should a timer be configured with a timestamp already in the past, the kernel will now automatically correct—or "clamp"—the expiration time to a sensible future value. This prevents the kernel from attempting to process an immediate or already-elapsed event, a condition that developers have termed a "stupid or malicious" DoS vector.
This measure acts as a crucial safety net with two key benefits. It contains the damage from accidental programming errors in drivers or kernel subsystems that might schedule timers incorrectly. More importantly, it blocks a deliberate attack path where a malicious actor with kernel-level privileges, potentially gained through an exploited process, could flood the system with invalid past-timers, consuming CPU cycles and starving other tasks.
The update exemplifies a defense-in-depth philosophy, fortifying a fundamental kernel primitive. Timers are deeply integrated into system operations, from scheduling tasks to managing network packets. By hardening this layer, Linux 7.2 enhances overall stability for servers, cloud infrastructure, and containers—all without requiring any configuration changes from administrators or users. This transparent hardening makes the kernel more resilient against both bugs and targeted exploits.
Linux 7.2 核心將為其計時器子系統帶來重要的安全增強，旨在阻截一類利用無效計時器請求的阻斷服務 (Denial-of-Service, DoS) 攻擊。
核心的改進在於為核心的計時器機制新增驗證檢查。若計時器被設定的時間戳記已屬過去，核心現在將自動將到期時間修正——或「限制」——至一個合理的未來值。這防止了核心嘗試處理一個即時或已過期的事件，開發者將此情況稱為「愚蠢或惡意」的 DoS 攻擊向量。
此措施充當了至關重要的安全網，帶來兩大主要好處。它能抑制驅動程式或核心子系統因程式設計錯誤而錯誤排程計時器所造成的損害。更重要的是，它封堵了一條蓄意攻擊的路徑：擁有核心級別權限（可能透過已遭利用的進程獲得）的惡意行為者，本可透過向系統大量灌入無效的過去計時器，從而消耗 CPU 週期並使其他任務資源匱乏。
這項更新體現了「縱深防禦」的理念，強化了一個基礎的核心原語。計時器深度整合於系統運作中，從任務排程到管理網絡數據包皆然。透過強化此層級，Linux 7.2 為伺服器、雲端基礎設施和容器提升了整體穩定性——且無需管理員或使用者進行任何設定變更。這種透明化的強化，使核心更能抵禦錯誤與有針對性的攻擊利用。