CVE-2026-97903

A flaw was found in the Linux kernel. A race condition during process termination allows a local user to trigger a use-after-free condition when process identifier records are freed prematurely. By running concurrent system operations during process exit, an unprivileged attacker can induce memory corruption, leading to a system crash and Denial of Service (DoS).

A moderate-severity use-after-free flaw was found in the Linux kernel process exit path. If another task still uses an exiting task's PID as its process group or session ID, release_task() can end up holding no reference to that struct pid, and a concurrently scheduled RCU-delayed put_pid() can free it while proc_flush_pid() still dereferences it, producing a slab use-after-free read in proc_invalidate_siblings_dcache(). An unprivileged local user can trigger this race by racing wait4() against setsid(), which can crash the kernel and cause a local denial of service; no controlled read, write, information disclosure, or privilege escalation has been demonstrated. Red Hat rates the impact of this flaw Moderate because exploitation requires winning a narrow timing race and the demonstrated consequence is denial of service (Red Hat CVSS 7.0, AV:L/AC:H), which differs from the upstream CVEORG rating of Important (CVSS 7.8). The vulnerable code is not present in the Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform kernel builds tracked for this flaw, so those products are not affected; the single new Red Hat Enterprise Linux 6 ELS record is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.