CVE-2026-98258

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tristate value to a boolean. This lost the distinction between "not owned by the firing list" and "still owned, but delivery was canceled". The resulting race is: expiry handler timer_settime() timer_delete() -------------- --------------- -------------- collect timer onto private firing list firing = true observes firing = true firing = false return TIMER_RETRY wait for handler observes firing = false finish deletion unhash and free timer resume list traversal read freed elist.next -> UAF The firing bit is clearly the wrong indicator since that commit. Check whether the timer is queued on the expiry list or not instead. If it is queued clear the firing bit to prevent signal delivery as before and return TIMER_RETRY so the caller unlocks the timer which allows the expiry code to make progress and remove it from the list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98258

EUVD

EUVD-2026-93186

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bf635681c906ad056d1fda325de8d1c12c9f8201
Linux	Linux	bf635681c906ad056d1fda325de8d1c12c9f8201
Linux	Linux	bf635681c906ad056d1fda325de8d1c12c9f8201
Linux	Linux	6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's POSIX CPU timer code. It occurs due to a race condition introduced when a boolean flag replaced a tristate value. The flaw allows a timer to be freed while still queued on an expiry list, leading to potential memory corruption when the list is traversed later.

Detection Guidance

This vulnerability is specific to the Linux kernel's POSIX CPU timer implementation. Detection requires checking the kernel version and verifying if the affected code path exists. Use commands like 'uname -r' to check the kernel version and examine the timer-related code in the kernel source.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, escalate privileges, or cause a system crash by exploiting the race condition. Systems using affected Linux kernel versions with POSIX CPU timer functionality are at risk.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's POSIX CPU timer subsystem. It does not directly affect compliance with GDPR, HIPAA, or similar standards, as those focus on data protection, privacy, and security controls rather than kernel-level race conditions.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the race condition in the POSIX CPU timer code. If patches are unavailable, consider disabling POSIX CPU timers if not required by your system.

Hi! I’m here to help you understand CVE-2026-98258. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70