The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the _timerstatstimersetstart_info function in kernel/time/timer.c.