CVE-2026-98260

CVE-2026-98260 is a use-after-free in the Linux kernel. It sits where exec() meets POSIX CPU timers.

A thread that is not the group leader calls exec(). The kernel hands that thread the leader's ID. If exec() then fails at a late step, the thread exits. A timer it owned is freed while still queued. Later cleanup touches the freed memory.

The fix moves the timer cleanup to right after the ID swap. That happens before any late failure can occur.

The Linux kernel CNA published the CVE on 6 October 2026. It scores the flaw CVSS 3.1 7.8 (High). NVD shows that score and has not added its own. Red Hat rates it Important at 7.8. Ubuntu gives it Medium priority.

The bug dates back to Linux 5.7. Fixed upstream releases are 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Debian has fixed kernels for bookworm, trixie and unstable. Red Hat lists RHEL 9 and 10 as affected, with fixes for some EUS and SAP streams. RHEL 6, 7 and 8 are not affected. Ubuntu had not released fixes on 19 October 2026.

Hyunwoo Kim (v4bel) disclosed the bug on 16 October 2026. It is one of six kernel flaws he calls "Infinity Core". He says it gives local root and container escape. He also says it gives root on a Samsung Galaxy S26 Ultra from an ordinary app.

The CVE is not in the CISA KEV catalog. No in-the-wild exploitation is reported. The researcher published a PoC in a GitHub repository. ThreatWire has not run it. The PoC link field points to it.