CVE-2026-98388

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

exec: do_close_on_exec() before taking exec_update_lock

do_close_on_exec() currently happens while holding the exec_update_lock,

which is used in a lot of places that access process state to

synchronize access checks.

I recently added another such use of exec_update_lock, causing a

regression.

do_close_on_exec() can block waiting for a reply from a filesystem.

That means a hung filesystem can block codepaths that use

exec_update_lock; and it also means that a FUSE filesystem which

attempts to inspect the calling process can deadlock.

To avoid such problems, move do_close_on_exec() before the

exec_update_lock is taken, but after the FD table has been copied if

necessary.

I have looked through all the calls between the old and new position of

the do_close_on_exec() call; there seems to be no file descriptor table

access in between.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References