UBUNTU-CVE-2026-97938: Use After Free
In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid() reads it and passes it to pidvnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cadpid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pidvnr() has finished dereferencing it, causing a use-after-free. killcadpid() has the same lifetime race when it passes cadpid to killpid(). At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cadpid was registered in pidtable[]. Moving cadpid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race. Fix this by treating cadpid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side. callrcu(&oldpid->rcu, ...) cannot be used here because freepid() also queues pid->rcu; queueing the same rcuhead twice can corrupt the RCU callback list. Original KASAN crash stack: kernel/pid.c:545 pidnrns() # reads freed pid->level kernel/pid.c:556 pidvnr() # calls pidnrns() kernel/pid.c:775 procdocadpid() # calls pidvnr(cadpid)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Treat the global cad_pid pointer as RCU-protected at both read sites, proc_do_cad_pid() and kill_cad_pid(), and wait for an RCU grace period before dropping the old struct pid reference on the write side. Do not queue the same rcu_head with call_rcu(), because free_pid() also queues pid->rcu.
- Compensating control
Move cad_pid back to the global reboot sysctl table so it is not registered in pid_table[] and cannot be reached through user and PID namespaces with the resulting namespace and permission mismatch.
Event History
Frequently Asked Questions
Who could trigger the vulnerable code path?
At the time the issue was reported, an unprivileged user could reach the relevant sysctl through user and PID namespaces because cad_pid was registered in the PID namespace sysctl table. The issue involves concurrent access to that sysctl-controlled pointer.
What conditions are needed to exploit the race?
An attacker needs a race between a reader of cad_pid and a concurrent writer replacing it. The old PID object must lose its final reference after the reader loads the pointer but before pid_vnr() or kill_pid() finishes dereferencing it.
Are systems still exposed through user and PID namespaces after the sysctl registration correction?
Moving cad_pid back to the global reboot sysctl table corrected the namespace and permission mismatch. However, that change alone did not address the underlying use-after-free race; the resolved fix also adds RCU lifetime protection and delays release of the old PID reference.