CVE-2026-97938

A flaw was found in the Linux kernel. A race condition in the reboot management subsystem allows a process identifier reference to be released while still being accessed by concurrent operations. A local attacker could exploit this use-after-free flaw to cause a Denial of Service (DoS) via a system crash or potentially escalate privileges.

A use-after-free race exists in the global cad_pid pointer handling. proc_do_cad_pid can pass a stale struct pid pointer to pid_vnr and kill_cad_pid can pass the same stale pointer to kill_pid while a concurrent sysctl writer replaces cad_pid and drops the final reference to the old pid object. The race can cause a kernel crash or incorrect PID object handling. For the CVSS the PR:H is used because reliably changing the global cad_pid sysctl normally requires administrator privileges in the initial user namespace. The issue is local and is not directly network reachable. The confirmed bug class is use-after-free. Limited confidentiality and integrity impact are retained only for the paranoid score because freed pid memory could be reused before dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.