UBUNTU-CVE-2026-98260: Use After Free

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up by that PID. When a non-leader thread exec()s, dethread() changes which task owns that PID. pidtask(timer->it.cpu.pid, PIDTYPEPID) then returns NULL, but the node is still queued on tsk, which is alive. timerlocksighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. beginnewexec() calls posixcputimersexit(me) right after exectasknamespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->pointofnoreturn is set before dethread(), so if unsharefiles(), setmmexefile(), execmmap() or exectasknamespaces() fails, the task dies before it gets there. exititimers() then frees the kitimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timercreate(CLOCKTHREADCPUTIMEID) timersettime() armtimer() // the node is queued on B execve() dethread(B) exchangetids(B, leader) // B's PID now belongs to the leader releasetask(leader) exitsignal(leader) posixcputimersexit(leader) // cleans leader's queue, not B's unhashprocess(leader) // that PID has no task anymore execmmap() mmapreadlockkillable(oldmm) kill(B, SIGKILL) // -EINTR getsignal() doexit() exititimers() posixtimerdelete() posixcputimerdel() posixtimerunhashandfree() // freed while still queued wait4() releasetask(B) posixcputimersexit(B) cleanuptimerqueue() timerqueuedel() // use-after-free Move the POSIX timer cleanup right after dethread() before any of the later failure conditions brings the task into doexit(). [ tglx: Move the cleanup right after dethread() ]