CVE-2026-98258

7.8 HIGH

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: A race condition in the Linux kernel's POSIX CPU timer implementation allows for a use-after-free vulnerability when a timer is being deleted while it's queued for expiration. This flaw occurs because the system incorrectly uses a 'firing' boolean flag instead of checking if the timer is actually queued on the expiry list, leading to premature timer deallocation.
Exploitability: Exploitation requires precise timing and concurrent access to POSIX CPU timers, making it moderately difficult but possible with controlled process scheduling and race conditions in multithreaded applications.
Blast radius: The vulnerability could affect any Linux system running processes that use POSIX CPU timers, potentially leading to kernel memory corruption and privilege escalation across multiple concurrent processes.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Apply the kernel patch from commit bf635681c906 or upgrade to Linux kernel version 6.10 or later where this race condition is fixed.

kernelrace-conditionmemory-corruption

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tristate value to a boolean. This lost the distinction between "not owned by the firing list" and "still owned, but delivery was canceled". The resulting race is: expiry handler timer_settime() timer_delete() -------------- --------------- -------------- collect timer onto private firing list firing = true observes firing = true firing = false return TIMER_RETRY wait for handler observes firing = false finish deletion unhash and free timer resume list traversal read freed elist.next -> UAF The firing bit is clearly the wrong indicator since that commit. Check whether the timer is queued on the expiry list or not instead. If it is queued clear the firing bit to prevent signal delivery as before and return TIMER_RETRY so the caller unlocks the timer which allows the expiry code to make progress and remove it from the list.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.