CVE-2026-98286

A flaw was found in the Linux kernel's drop_monitor subsystem. A local user can trigger this issue during monitor teardown under memory pressure, where a race condition allows a timer to be re-armed after it has been cancelled. When the module is subsequently unloaded, the active timer executes within freed memory, leading to a use-after-free vulnerability that can cause a Denial of Service (DoS) via a kernel crash.

A race in drop_monitor teardown can allow dm_alert_work to rearm a per CPU send_timer after timer_delete_sync has already returned. If the work is then cancelled and the module reference is released, the active timer may later invoke sched_send_work from unloaded module memory. This creates a use after free condition and can cause a kernel panic. For the CVSS the PR:H is selected because reliable triggering normally requires administrative control over drop_monitor teardown and module unloading. AC:H is selected because exploitation also depends on a narrow race window and a memory allocation failure while the worker is resetting per CPU state. The issue is not directly network reachable because packet traffic alone cannot perform the required teardown or unload operation. Impact is at least a local denial of service. In the paranoid case limited confidentiality or integrity impact is considered because execution can continue through a stale timer callback after module memory has been freed, although a reliable privilege escalation primitive is not established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.