CVE-2026-98286

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

In drop_monitor teardown paths (net_dm_trace_off_set(),

net_dm_hw_monitor_stop(), and error unwind paths in net_dm_trace_on_set()

and net_dm_hw_monitor_start()), per-CPU timers are stopped using

timer_delete_sync() followed by cancel_work_sync().

However, there is a circular dependency between send_timer and

dm_alert_work:

1) sched_send_work() (timer callback) schedules dm_alert_work.

2) send_dm_alert() / net_dm_hw_summary_work() calls reset_per_cpu_data()

or net_dm_hw_reset_per_cpu_data().

3) If memory allocation fails under memory pressure in the reset

function, it re-arms the timer via mod_timer(&data->send_timer, ...).

If dm_alert_work is running concurrently while timer_delete_sync()

executes on another CPU, an allocation failure in the worker will

re-arm the timer after timer_delete_sync() has already returned.

Once cancel

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References