Look up another CVE · open CVE-2026-98258 in the interactive tracker
CVE-2026-98258
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem kernel/time. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-98258 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tristate value to a boolean. This lost the distinction between "not owned by the firing list" and "still owned, but delivery was canceled". The resulting race is: expiry handler timer_settime() timer_delete() -------------- --------------- -------------- collect timer onto private firing list firing = true observes firing = true firing = false return TIMER_RETRY wait for handler observes firing = false finish deletion unhash and free timer resume list traversal read freed elist.next -> UAF The firing bit is clearly the wrong indicator since that commit. Check whether the timer is queued on the expiry list or not instead. If it is queued clear the firing bit to prevent signal delivery as before and return TIMER_RETRY so the caller unlocks the timer which allows the expiry code to make progress and remove it from the list.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/time/posix-cpu-timers.c
- What this is
- POSIX CLOCKS and TIMERSMAINTAINERS section matched on kernel/time/posix-* · linux-kernel@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_POSIX_TIMERS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_POSIX_TIMERS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/time
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.13 | 6.18.54 | 9971dac1a778 |
| 6.13 | 7.2.8 | 4336e3f47d9d |
| 6.13 | 7.3 | c21eaa72f02f |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Triggered only through local syscalls timer_create() with a CPU-time clock, timer_settime() and timer_delete(), which reach posix_cpu_timer_set()/posix_cpu_timer_del() and race handle_posix_cpu_timers(); no remote peer supplies any input.
- AC:LAttack complexity, low
- The attacker controls all three sides of the race: they make the timer expire by burning CPU, and run timer_settime() and timer_delete() on their own timer from sibling threads. Putting many timers on the firing list widens the traversal window, and the handler is preemptible task_work, so the attempt can be repeated at will.
- PR:LPrivileges required, low
- posix CPU timers are available to any unprivileged process on its own threads or process; posix_cpu_timer_create(), timer_settime and timer_delete do no capability check, so an ordinary local user account is enough.
- UI:NUser interaction, none
- The attacker's own process creates, arms and deletes the timers; no other user or administrator has to do anything.
- S:UScope, unchanged
- The memory corruption is in the kernel's own k_itimer slab objects and leads to kernel privilege escalation in the same security authority, with no hypervisor or IOMMU boundary crossed.
- C:HConfidentiality impact, high
- After kfree_rcu frees the k_itimer, the handler keeps using it through the cached it.cpu.elist next pointer. A sprayed replacement object makes the handler follow attacker-chosen list pointers and k_itimer fields, the same primitive class used in the in-the-wild CVE-2025-38352 exploit, so kernel memory disclosure is achievable.
- I:HIntegrity impact, high
- The handler does list_del_init() on the freed timer's elist and writes firing/handling, so it writes into reallocated memory. With a controlled replacement, the list unlink becomes a write primitive that can be built into privilege escalation.
- A:HAvailability impact, high
- Even an unexploited race corrupts the slab or makes the handler dereference a freed or reused list pointer, producing a KASAN report, list corruption BUG or kernel oops that crashes the system.