CVE-2026-98258

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

Kijo analyzed another race in the POSIX CPU timer code:

Commit bf635681c906 converted cpu_timer::firing from a tristate value to a

boolean. This lost the distinction between "not owned by the firing list"

and "still owned, but delivery was canceled". The resulting race is:

expiry handler timer_settime() timer_delete()

-------------- --------------- --------------

collect timer onto

private firing list

firing = true

observes firing = true

firing = false

return TIMER_RETRY

wait for handler

observes firing = false

finish deletion

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References