Eric, I am sick today and can't read the code, but I feel this patch is not right ... please correct me. So, iiuc when posix_cpu_timer_create() is called and CPUCLOCK_PERTHREAD is false we roughly have task = pid_task(pid, PIDTYPE_TGID); // lookup_task() /* WINDOW */ timer->it.cpu.pid = = get_task_pid(task, PIDTYPE_TGID) // posix_cpu_timer_create() Now suppose that we race with mt-exec and this "task" is the old leader; it can be release_task()'ed in the WINDOW above and then get_task_pid() will return NULL. That is why I suggested to change lookup_task() to return "struct pid*" to eliminate the pid -> task -> pid transition. Apart from the same_thread_group() check for the "thread" case we do not need task_struct at all, lookup_task() can do if (thread) { p = pid_task(pid, PIDTYPE_PID); if (p && !same_thread_group(p, current)) pid = NULL; } else { ... gettime check ... if (!pid_has_task(pid, PIDTYPE_TGID)) pid = NULL; } return pid; No? Oleg.