CVE-2026-98260

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigger a use-after-free condition, leading to a system crash and Denial of Service (DoS) or potential privilege escalation.

Red Hat has evaluated this vulnerability as having an Important severity impact because an authenticated local attacker can trigger kernel memory corruption to escalate privileges or induce a denial of service. The issue stems from an error handling failure during an execve syscall in multithreaded applications, where POSIX CPU timers are prematurely freed while remaining queued. While exploitation requires local execution privileges to set up timers and intercept process image replacement, the potential to corrupt active kernel timer queues poses a severe threat to system stability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.