CVE-2026-98258: race condition UAF in Linux kernel

Race condition UAF in Linux kernel (POSIX CPU timers). CVSS 7.8. Public PoC. Urgent patching.

CVE-2026-98258 is a race condition in the POSIX CPU timer code of the Linux kernel. A loss of distinction between timers not owned by the firing list and timers still owned but with delivery canceled creates a use-after-free (UAF) situation. A running thread can free a timer's memory while another thread accesses it, potentially causing kernel crash or code execution. The flaw affects the Linux kernel broadly, impacting all Linux-based operating systems.

The severity is high: CVSS 7.8. The NVD confirms the 'high' classification and the flaw was published on October 6, 2026. As of November 1, 2026, public proof-of-concept (PoC) code is available on GitHub repositories, signaling that the attack vector is documented and reproducible. It was not reported whether patches are already available in the mainline kernel. Technical signals are consistent: the NVD description confirms the root cause (commit bf635681c906) and the race condition mechanism.

System administrators must verify the version of the Linux kernel in use by consulting security bulletins from your Linux distribution. Monitor security channels actively for patch releases. In the meantime, on high-risk multi-user systems, document unexpected kernel behavior such as unplanned crashes and reduce exposure by restricting access to POSIX timer modification operations. Once the official patch is available from your distribution, schedule kernel update during a priority maintenance window.

At a glance

What: Race condition in the posix-cpu-timers code of the Linux kernel. Loss of distinction between timer ownership states generates a use-after-free (UAF) when the expiry handler, timer_settime(), and timer_delete() race to access the same timer. One thread can free memory while another accesses it.
Severity: CVSS 7.8 (high). Potential kernel crash or privilege escalation via arbitrary code execution.
Affected versions: Not reported in the official NVD description. The defect in posix-cpu-timers code suggests the Linux kernel; consult your distribution's security bulletins for the list of affected versions.
Fix: Check whether the timer is queued on the expiry list instead of using the firing bit as the sole ownership indicator; clear firing to false and return TIMER_RETRY to allow the handler to progress and remove the timer from the list.
Status: Published on NVD October 6, 2026. Public proof-of-concept available on GitHub repositories as of November 1, 2026. Official mainline kernel patch status not confirmed in the data.
Action: Contact your Linux distribution vendor immediately for priority patch. Monitor security bulletins. On high-risk systems, consider temporary restrictions on POSIX timer operations in multi-user environments until patching is complete.

Sources: NVD, CVE-2026-98258

← All articles