Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-98260— exec: Cleanup POSIX timers right after de_thread()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： exec：在之后立即清理 POSIX 定时器每个线程级的 CPU 定时器都持有与其所附加线程相关的 PID 引用；当定时器处于激活状态（armed）时，其节点会被插入到该线程的队列中。系统会通过该 PID 来查找对应的任务（task）。当一个非主线程（non-leader thread）执行时，会更改该 PID 的所有者。此时，调用会返回，但该节点仍然挂在原任务（）上，而该任务仍处于存活状态。将查找失败视为“节点已被出队”，因此认为无需进行任何撤销操

CVSS 7.8 · High EPSS 0.13% · P3 Updated Oct 07, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59< 6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce`	affected
		`55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59< d9ae467e617ca29b825493a362bf0d75ad5f4ac3`	affected
		`55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59< 75aa08b93c65766040f9ca99f41ac85ad22596b6`	affected
		`55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59< d602877baf36c43c788a5f472c977e0be414029f`	affected
		`55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59< acb03d3881818581052924a9bbbe92b8741ed448`	affected
		`5.7`	affected
		`< 5.7`	unaffected
		`6.6.158≤ 6.6.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

exec: Cleanup POSIX timers right after de_thread()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve() de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader) __exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's __unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm) kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete() posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B) posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit(). [ tglx: Move the cleanup right after de_thread() ]

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 ~ 6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce	-
Linux	Linux	5.7	-

II. Public POCs for CVE-2026-98260

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-98260

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98260 (5)

https://www.cve.org/CVERecord?id=CVE-2026-98260

Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total

CVE-2026-98323	9.8 CRITICAL	RDMA/siw: Bound fragmented header copies by the remaining length
CVE-2026-98365	9.8 CRITICAL	RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
CVE-2026-98282	8.8 HIGH	powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
CVE-2026-98283	8.8 HIGH	KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
CVE-2026-98339	8.8 HIGH	wifi: cfg80211: don't filter by BSS type when removing stale entries
CVE-2026-98171	8.8 HIGH	smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
CVE-2026-98261	8.1 HIGH	cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
CVE-2026-98357	8.1 HIGH	IB/isert: wait for deferred control PDU completions before releasing the connection
CVE-2026-98239	8.1 HIGH	net: lan743x: fix RX checksum use-after-free
CVE-2026-98341	7.8 HIGH	wifi: cfg80211: don't free driver-owned scan requests
CVE-2026-98324	7.8 HIGH	dmaengine: pxa: fix double counting of the hw descriptors
CVE-2026-98320	7.8 HIGH	netfilter: flowtable: hold reference on ct until flow is released
CVE-2026-98228	7.8 HIGH	mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
CVE-2026-98229	7.8 HIGH	xfrm: save input state data before secpath resets
CVE-2026-98318	7.8 HIGH	smb: client: validate absolute native symlink targets before NT fixups
CVE-2026-98315	7.8 HIGH	ntfs: protect runlist updates with the runlist lock
CVE-2026-98276	7.8 HIGH	net: lock the socket in sock_gettstamp()
CVE-2026-98256	7.8 HIGH	signal: Prevent exec() race
CVE-2026-98258	7.8 HIGH	posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
CVE-2026-98254	7.8 HIGH	swiotlb: use the adjusted address for the highmem page lookup

Showing top 20 of 208 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2026-98260

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-98260— exec: Cleanup POSIX timers right after de_thread()

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 12

I. Basic Information for CVE-2026-98260

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-98260

III. Intelligence Information for CVE-2026-98260

Patches & Fixes for CVE-2026-98260 (5)

Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-98260

Leave a comment