#exec

Kernel race after non-leader exec frees POSIX timer on signal list

Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.