CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread()
exec: Cleanup POSIX timers right after dethread()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.8-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
Move the POSIX timer cleanup (posix_cpu_timers_exit(me)) to immediately after de_thread() and before later failure paths such as unshare_files(), set_mm_exe_file(), exec_mmap(), or exec_task_namespaces().
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A non-leader thread must execute exec() while a per-thread CPU POSIX timer associated with that thread is armed. An exec-stage operation must then fail after de_thread() but before begin_new_exec() reaches the timer cleanup.
What is the failure mode if the vulnerable path is reached?
The task can exit with a timer node still queued in its POSIX CPU timer tree. exit_itimers() frees the timer, and later reaping the task can erase the freed node from the rbtree, creating a use-after-free condition.
What should be prioritized when assessing exposure?
Prioritize systems where applications create armed per-thread CPU timers and allow non-leader threads to call exec(). The described failure additionally depends on errors in unshare_files(), set_mm_exe_file(), exec_mmap(), or exec_task_namespaces() after de_thread().