Read the docs
TI-2026-68151 Aliases CVE-2026-98260GHSA-pr95-77xq-3v99

Use-after-free in Linux kernel POSIX timer cleanup during exec

Priority LOW 33Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 30 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

The Linux kernel from 5.7 before the fixed releases is affected. A POSIX CPU timer on a non-leader thread stays queued when exec() changes that thread's PID and a later step fails, so the task dies with the timer still linked. Reaping the task then frees memory still in use, a use-after-free. A local user with low privileges can trigger this, with high confidentiality, integrity and availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve() de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader) __exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's __unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm) kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete() posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B) posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit(). [ tglx: Move the cleanup right after de_thread() ]

Why it matters now

EPSS 0.00185 8th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1.191, 6.6.158, 6.12.112 +3Red Hat: 7 advisoriesRed Hat: 30 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.7 and later6.1.191, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3Patch availableCNA
  • Linux VendorLinux Affected 5.7 and later Fixed in 6.1.191, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Update the Linux kernel to 6.1.191, 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3. Red Hat fixes its listed Red Hat Enterprise Linux products in advisories RHSA-2026:86033, RHSA-2026:85321, RHSA-2026:83797, RHSA-2026:83775, RHSA-2026:83738, RHSA-2026:83739 and RHSA-2026:83707. Red Hat lists Red Hat Enterprise Linux 9 as affected without a fix and with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3

Red Hat 7 advisories

  • RHSA-2026:86033 Released 2026-10-20 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.59.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.59.1.el9_8, kernel-64k-devel-5.14.0-687.59.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.59.1.el9_8, kernel-64k-5.14.0-687.59.1.el9_8, kernel-64k-core-5.14.0-687.59.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.59.1.el9_8, libperf-5.14.0-687.59.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.59.1.el9_8, kernel-rt-64k-5.14.0-687.59.1.el9_8, kernel-rt-64k-core-5.14.0-687.59.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.59.1.el9_8, kernel-rt-core-5.14.0-687.59.1.el9_8, kernel-rt-debug-5.14.0-687.59.1.el9_8 +9
  • RHSA-2026:85321 Released 2026-10-19 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • 10Base-SMTV kernel-modules-internal-6.12.0-211.67.1.el10_2
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.67.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.67.1.el10_2, kernel-64k-devel-6.12.0-211.67.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.67.1.el10_2, kernel-64k-6.12.0-211.67.1.el10_2, kernel-64k-core-6.12.0-211.67.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.67.1.el10_2, libperf-6.12.0-211.67.1.el10_2
    • Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal-6.12.0-211.67.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.67.1.el10_2, kernel-rt-64k-6.12.0-211.67.1.el10_2, kernel-rt-64k-core-6.12.0-211.67.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.67.1.el10_2, kernel-rt-core-6.12.0-211.67.1.el10_2, kernel-rt-debug-6.12.0-211.67.1.el10_2 +9
  • RHSA-2026:83797 Released 2026-10-16 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.156.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.156.1.el9_4, kernel-64k-devel-5.14.0-427.156.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.156.1.el9_4, kernel-5.14.0-427.156.1.el9_4, kernel-64k-5.14.0-427.156.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.156.1.el9_4, kernel-rt-core-5.14.0-427.156.1.el9_4, kernel-rt-debug-5.14.0-427.156.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.156.1.el9_4, kernel-rt-core-5.14.0-427.156.1.el9_4, kernel-rt-debug-5.14.0-427.156.1.el9_4 +11
Show 4 more Red Hat advisories
  • RHSA-2026:83775 Released 2026-10-16 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.149.1.el9_6, libperf-5.14.0-570.149.1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.149.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.149.1.el9_6, kernel-64k-devel-5.14.0-570.149.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.149.1.el9_6, kernel-64k-5.14.0-570.149.1.el9_6, kernel-64k-core-5.14.0-570.149.1.el9_6 +28
    • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.149.1.el9_6, kernel-rt-64k-5.14.0-570.149.1.el9_6, kernel-rt-64k-core-5.14.0-570.149.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.149.1.el9_6, kernel-rt-core-5.14.0-570.149.1.el9_6, kernel-rt-debug-5.14.0-570.149.1.el9_6 +11
  • RHSA-2026:83738 Released 2026-10-16 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.198.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.198.1.el9_2, kernel-64k-devel-5.14.0-284.198.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.198.1.el9_2, kernel-5.14.0-284.198.1.el9_2, kernel-64k-5.14.0-284.198.1.el9_2 +29
  • RHSA-2026:83739 Released 2026-10-16 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.198.1.rt14.483.el9_2, kernel-rt-core-5.14.0-284.198.1.rt14.483.el9_2, kernel-rt-debug-5.14.0-284.198.1.rt14.483.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.198.1.rt14.483.el9_2, kernel-rt-core-5.14.0-284.198.1.rt14.483.el9_2, kernel-rt-debug-5.14.0-284.198.1.rt14.483.el9_2 +11
  • RHSA-2026:83707 Released 2026-10-16 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.111.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.111.1.el10_0, kernel-64k-devel-6.12.0-55.111.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.111.1.el10_0, kernel-64k-6.12.0-55.111.1.el10_0, kernel-64k-core-6.12.0-55.111.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.111.1.el10_0, libperf-6.12.0-55.111.1.el10_0
    • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.111.1.el10_0, kernel-rt-64k-6.12.0-55.111.1.el10_0, kernel-rt-64k-core-6.12.0-55.111.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.111.1.el10_0, kernel-rt-core-6.12.0-55.111.1.el10_0, kernel-rt-debug-6.12.0-55.111.1.el10_0 +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
10Base-SMTVFixed RHSA-2026:85321
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:83775
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86033
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:83738
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:83797
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:83707
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:83775
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:86033
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:83738
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:83797
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:83707
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:83775
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:86033
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:83707
Red Hat Enterprise Linux Hidden (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:86033
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2026:83739
Red Hat Enterprise Linux Real Time E4S (v.9.4)Fixed RHSA-2026:83797
Red Hat Enterprise Linux Real Time EUS (v. 10.0)Fixed RHSA-2026:83707
Red Hat Enterprise Linux Real Time EUS (v.9.6)Fixed RHSA-2026:83775
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:85321
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:86033
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2026:83739
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)Fixed RHSA-2026:83797
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)Fixed RHSA-2026:83707
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)Fixed RHSA-2026:83775
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-98260
  2. 2026-10-06 Alias added: GHSA-pr95-77xq-3v99
  3. 2026-10-07 CVSS score added · CNA
  4. 2026-10-11 Affected versions changed · Red Hat
  5. 2026-10-11 CVSS score added · Red Hat
  6. 2026-10-13 Affected versions changed · Red Hat
  7. 2026-10-13 CVSS score changed · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83738 · Red Hat
  9. 2026-10-16 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · Red Hat
  10. 2026-10-18 Fix available: RHSA-2026:83775 · Red Hat
  11. 2026-10-18 Fix available: RHSA-2026:83739 · Red Hat
  12. 2026-10-18 Fix available: RHSA-2026:83707 · Red Hat
  13. 2026-10-18 Fix available: RHSA-2026:83797 · Red Hat
  14. 2026-10-18 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v. 10.0) +13 · Red Hat
  15. 2026-10-19 Fix available: Linux/[email protected] · CNA
  16. 2026-10-20 Fix available: RHSA-2026:85321 · Red Hat
  17. 2026-10-20 Fix available: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) +4 · Red Hat
  18. 2026-10-21 Fix available: RHSA-2026:86033 · Red Hat
  19. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) +2 · Red Hat
  20. 2026-10-30 Fix available: Linux/[email protected], Linux/Linux@f6c93e8ecaaf12959b7ef6eb611351001db2ff5d · CNA
  21. 2026-10-30 1 new reference · CNA

References

Other 6

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21727 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences