CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread()

Published Oct 6, 2026

Updated

exec: Cleanup POSIX timers right after dethread()

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:45 AM

Data Sourced

via MITRE·08:45 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Oct 7, 2026

Data Sourced

via Microsoft·08:12 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger this issue?

A non-leader thread must execute exec() while a per-thread CPU POSIX timer associated with that thread is armed. An exec-stage operation must then fail after de_thread() but before begin_new_exec() reaches the timer cleanup.

What is the failure mode if the vulnerable path is reached?

The task can exit with a timer node still queued in its POSIX CPU timer tree. exit_itimers() frees the timer, and later reaping the task can erase the freed node from the rbtree, creating a use-after-free condition.

What should be prioritized when assessing exposure?

Prioritize systems where applications create armed per-thread CPU timers and allow non-leader threads to call exec(). The described failure additionally depends on errors in unshare_files(), set_mm_exe_file(), exec_mmap(), or exec_task_namespaces() after de_thread().

CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread()

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the failure mode if the vulnerable path is reached?

What should be prioritized when assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the failure mode if the vulnerable path is reached?

What should be prioritized when assessing exposure?