CVE-2026-98286: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown
dropmonitor: use timershutdownsync() to prevent timer rearming during teardown
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Replace timer_delete_sync() with timer_shutdown_sync() in net_dm_trace_off_set(), net_dm_hw_monitor_stop(), and the error-unwind paths in net_dm_trace_on_set() and net_dm_hw_monitor_start() to prevent timer rearming during teardown.
Linux kernel drop_monitor per-CPU timer teardown API = timer_shutdown_sync()
Event History
Frequently Asked Questions
What conditions are needed for this to become a use-after-free?
A drop_monitor teardown must race with its alert work, and a memory-allocation failure in the worker must cause the per-CPU timer to be re-armed after timer deletion has completed. The module must then be unloaded while that re-armed timer remains pending.
When does the unsafe code execute?
The failure occurs when the pending timer later fires after the module has been unloaded. Its callback can then run code from freed module memory.
Which operations are involved in the affected teardown race?
The race is present in drop_monitor trace and hardware-monitor teardown paths, including net_dm_trace_off_set(), net_dm_hw_monitor_stop(), and error unwind paths for trace and hardware-monitor startup.