CVE-2026-98256

A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege escalation or trigger a system crash resulting in a Denial of Service (DoS).

This vulnerability is rated as an Important severity flaw because an authenticated local user can leverage concurrent process execution and timer signal delivery to corrupt kernel heap memory, potentially resulting in elevated privileges or an immediate kernel panic. Triggering the flaw requires local execution privileges to manipulate POSIX timers across multithreaded process state transitions. Earlier releases such as Red Hat Enterprise Linux 8 and 9 are not vulnerable as they do not include the affected signal management changes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.