From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B11F3DFC80 for ; Tue, 6 Oct 2026 10:26:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282367; cv=none; b=h9OOIGEy3l8+BoBi3ENitl5ZDY58CcHs/X0LCpGb6Bt+rZuPQkoE5UNxf0SuANrEU2Z2IeGpDel/RhG9VGiCbGmVQa60PlefoioYkdrhJqfP8h5+E1u9lUGgx1xy2dnVZqnDqVo0UTxroiz/xYQEfFkODF/y1Q4E2VWtSAOcHH0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282367; c=relaxed/simple; bh=BK6C+VSWyoLfDJxAPBQEhYZvuy4G6KBOQp6RYTMHCOY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dsulhC4wIKqv3N5BUE8gqieulzwXt4Cu/to+JhNX/sjlujo22/d+RHmgsy/M5kTSwdY3PY4N760q+A5Tg6r3ldwXjLUu1Y9VHjAGUtWOnN3dL/4/kqkqWXTgzw0Bw81a/gprYz/ruuJBltDR6DjiynK1huT/mUSHVVaqM9mpraY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=T7twM1HQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="T7twM1HQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 656FD1F000FF; Tue, 6 Oct 2026 10:26:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791282366; bh=B4F9yKZ2F+qy6g6mVQGZw4GmJVqpHRjz29SD/1pydes=; h=From:To:Cc:Subject:Date:Reply-To; b=T7twM1HQCTrJzfMJFSD1nMcvDru6Q2q9dpLYMg8Ch9MvH2tX31yofo9TsGjFdNTst d3eiS5PE+cazheRKTVVyXlm/Mc0PsGOZeJqfs7PsX2kwQBMCZUyx+KoTVltZvHvckL QSI7+BEh73I2d5g37iLWaJP1u3Shq3TmTB8EhrDI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98256: signal: Prevent exec() race Date: Tue, 6 Oct 2026 10:45:57 +0200 Message-ID: <2026100656-CVE-2026-98256-32cb@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=7194; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nLlY0IKnjOIEz7/7fgQko2QdNym/ryhaHAqFwiOVw6A=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlHtnLovpTWOGXwa96ho5vMJG+7Tbr46PU+nfIZWwzaJ DW7+/STOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAi9VkM86xvnTnxXPKHqMDV WZohU+epbrpb1MAw3+2L5D52yRyboIkr1r3SVK110ZC5BwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0 __x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030 __x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0 kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation: kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90 begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained: de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID timer created against the leader's tid now points to the thread which called execve(). pid_task() returns that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays queued on the leader's task::pending. The next expiry of that timer can then run while release_task() flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values again, so the entry is not removed from the list. It is still there after the last reference is dropped and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that there is no reason to flush task::pending late in release_task() and it should be done in exit_signals() already. As nothing can collect and deliver signals which are queued in a dying task's pending queue, there is no reason to delay it further. But it has to be ensured that no signals can be queued into it after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock - Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-stack list head under sighand lock and free the signals without the lock held. There has been quite some discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is that a third party which tries to send a posix timer signal relies on the PID lookup to find the target task and that lookup might result in the new leader when the signal was originaly directed to the old leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over the following situation: old_leader new_leader third party A: flush_list() // list_del_init() stores to sigqueue LOCK (tasklist) old_leader->exit_state = EXIT_ZOMBIE; B: UNLOCK (tasklist) C: LOCK (tasklist) if (old_leader->exit_state) transfer_tids() D: store PID posix_timer_send_sigqueue() // Observes #D so t = new_leader E: t = get_target() F: LOCK (sighand) G: if (list_empty(sigqueue)) list_add(sigqueue) The concern was that the third party might observe #D but not observe #A and therefore would proceed to #G while the list_del() stores (#A) in flush_list() are not visible yet, which could result in list corruption. That would be possible if looking at it solely from a RELEASE+ACQUIRE ordering point of view, but B-C is a UNLOCK+LOCK hand-over, which is not the same as RELEASE+ACQUIRE: RELEASE+ACQUIRE: RCpc, only the CPUs involved agree on the ordering UNLOCK+LOCK: RCtso, the hand-over is store-ordering As B-C is UNLOCK+LOCK, which is RCtso and that does impose store order, A stores must happen before the D store. Combine with E-F, which has a data dependency from the LOAD to the LOCK and thereby constraints later LOADs, those sigqueue loads in G that come after F must in fact observe the A stores. The Linux kernel CVE team has assigned CVE-2026-98256 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit fb3bbcfe344e64a46574a638b051ffd78762c12d and fixed in 6.18.54 with commit 621c365739828900f32a0c1cdfe5387528a62176 Issue introduced in 6.15 with commit fb3bbcfe344e64a46574a638b051ffd78762c12d and fixed in 7.2.8 with commit 934bd95f1a6404dbb845951b823547abab05a649 Issue introduced in 6.15 with commit fb3bbcfe344e64a46574a638b051ffd78762c12d and fixed in 7.3-rc4 with commit d2710c8d938ae6a825a6463158e6e6f31eac792a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98256 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/exit.c kernel/signal.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/621c365739828900f32a0c1cdfe5387528a62176 https://git.kernel.org/stable/c/934bd95f1a6404dbb845951b823547abab05a649 https://git.kernel.org/stable/c/d2710c8d938ae6a825a6463158e6e6f31eac792a