CVE-2026-98258 (GCVE-0-2026-98258)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tristate value to a boolean. This lost the distinction between "not owned by the firing list" and "still owned, but delivery was canceled". The resulting race is: expiry handler timer_settime() timer_delete() -------------- --------------- -------------- collect timer onto private firing list firing = true observes firing = true firing = false return TIMER_RETRY wait for handler observes firing = false finish deletion unhash and free timer resume list traversal read freed elist.next -> UAF The firing bit is clearly the wrong indicator since that commit. Check whether the timer is queued on the expiry list or not instead. If it is queued clear the firing bit to prevent signal delivery as before and return TIMER_RETRY so the caller unlocks the timer which allows the expiry code to make progress and remove it from the list.
References
Impacted products
Vendor Product Version
Linux Linux Version: bf635681c906ad056d1fda325de8d1c12c9f8201
Version: bf635681c906ad056d1fda325de8d1c12c9f8201
Version: bf635681c906ad056d1fda325de8d1c12c9f8201
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-cpu-timers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9971dac1a77845ff467146915fcbb9170f6a8209",
              "status": "affected",
              "version": "bf635681c906ad056d1fda325de8d1c12c9f8201",
              "versionType": "git"
            },
            {
              "lessThan": "4336e3f47d9d516441066e9a65eaf076790d8d45",
              "status": "affected",
              "version": "bf635681c906ad056d1fda325de8d1c12c9f8201",
              "versionType": "git"
            },
            {
              "lessThan": "c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd",
              "status": "affected",
              "version": "bf635681c906ad056d1fda325de8d1c12c9f8201",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-cpu-timers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent freeing a timer which is queued on the expiry list\n\nKijo analyzed another race in the POSIX CPU timer code:\n\nCommit bf635681c906 converted cpu_timer::firing from a tristate value to a\nboolean. This lost the distinction between \"not owned by the firing list\"\nand \"still owned, but delivery was canceled\". The resulting race is:\n\n    expiry handler              timer_settime()        timer_delete()\n    --------------              ---------------        --------------\n    collect timer onto\n    private firing list\n    firing = true\n                                observes firing = true\n                                firing = false\n                                return TIMER_RETRY\n                                wait for handler\n                                                       observes firing = false\n                                                       finish deletion\n                                                       unhash and free timer\n    resume list traversal\n    read freed elist.next\n    -\u003e UAF\n\nThe firing bit is clearly the wrong indicator since that commit.\n\nCheck whether the timer is queued on the expiry list or not instead. If it\nis queued clear the firing bit to prevent signal delivery as before and\nreturn TIMER_RETRY so the caller unlocks the timer which allows the expiry\ncode to make progress and remove it from the list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered only through local syscalls timer_create() with a CPU-time clock, timer_settime() and timer_delete(), which reach posix_cpu_timer_set()/posix_cpu_timer_del() and race handle_posix_cpu_timers(); no remote peer supplies any input.\nAC:L - The attacker controls all three sides of the race: they make the timer expire by burning CPU, and run timer_settime() and timer_delete() on their own timer from sibling threads. Putting many timers on the firing list widens the traversal window, and the handler is preemptible task_work, so the attempt can be repeated at will.\nPR:L - posix CPU timers are available to any unprivileged process on its own threads or process; posix_cpu_timer_create(), timer_settime and timer_delete do no capability check, so an ordinary local user account is enough.\nUI:N - The attacker\u0027s own process creates, arms and deletes the timers; no other user or administrator has to do anything.\nS:U - The memory corruption is in the kernel\u0027s own k_itimer slab objects and leads to kernel privilege escalation in the same security authority, with no hypervisor or IOMMU boundary crossed.\nC:H - After kfree_rcu frees the k_itimer, the handler keeps using it through the cached it.cpu.elist next pointer. A sprayed replacement object makes the handler follow attacker-chosen list pointers and k_itimer fields, the same primitive class used in the in-the-wild CVE-2025-38352 exploit, so kernel memory disclosure is achievable.\nI:H - The handler does list_del_init() on the freed timer\u0027s elist and writes firing/handling, so it writes into reallocated memory. With a controlled replacement, the list unlink becomes a write primitive that can be built into privilege escalation.\nA:H - Even an unexploited race corrupts the slab or makes the handler dereference a freed or reused list pointer, producing a KASAN report, list corruption BUG or kernel oops that crashes the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:16:29.418Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9971dac1a77845ff467146915fcbb9170f6a8209"
        },
        {
          "url": "https://git.kernel.org/stable/c/4336e3f47d9d516441066e9a65eaf076790d8d45"
        },
        {
          "url": "https://git.kernel.org/stable/c/c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd"
        }
      ],
      "title": "posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98258",
    "datePublished": "2026-10-06T08:45:23.379Z",
    "dateReserved": "2026-09-25T10:25:14.332Z",
    "dateUpdated": "2026-10-19T09:16:29.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.