CVE-2026-98256

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

signal: Prevent exec() race

Hyunwoo debugged the following KASAN UAF splat:

BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0

Write of size 8 at addr ffff888007ed80c8 by task poc/79

...

Call Trace:

__send_signal_locked+0xb27/0xba0

do_send_sig_info+0xa7/0x160

do_send_specific+0x76/0xa0

__x64_sys_tgkill+0x193/0x270

...

Allocated by task 80:

do_timer_create+0x1a4/0x1030

__x64_sys_timer_create+0x145/0x190

...

Freed by task 12:

kmem_cache_free_bulk+0x1f8/0x4a0

kvfree_rcu_bulk+0x14f/0x1c0

kfree_rcu_work+0x128/0x1a0

...

Last potentially related work creation:

kvfree_call_rcu+0x39/0x390

__flush_itimer_signals+0x211/0x320

flush_itimer_signals+0x47/0x90

begin_new_exec+0xa6b/0x28c0

It turned out that this happens with a non-leader exec() as Hyunwoo

explained:

de_thread() calls exchange_tids() before release_task(leader), so the

struct pid held by a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References