Description
In the Linux kernel, the following vulnerability has been resolved:

reboot: fix cad_pid use-after-free race

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level
kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()
kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel-Level Use-After-Free
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free race on the kernel‑wide cad_pid pointer. An unprivileged user can trigger the race via sysctl calls in user and PID namespaces. When a writer replaces cad_pid while a reader is accessing it, the freed pointer can be dereferenced by pid_vnr or kill_pid, leading to memory corruption. This can cause a kernel crash (service disruption) and potentially enable privilege escalation if an attacker can influence the freed memory. The weakness is a race condition leading to memory corruption (CWE‑416).

Affected Systems

This issue affects the Linux kernel. Any kernel build containing the cad_pid pointer race before the fix is vulnerable. Version information is not specified, but the problem existed in earlier kernel releases that did not incorporate the RCU protection and grace‑period fix.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in KEV. The vulnerability is exploitable from a local, unprivileged user context that can manipulate sysctl settings or create PID namespaces. The primary consequence is a kernel crash, but the underlying memory corruption could be leveraged for code execution or privilege escalation if an attacker gains control over the freed memory. No public exploits are known, yet the presence of a kernel‑level use‑after‑free warrants immediate remediation.

Generated by OpenCVE AI on September 25, 2026 at 18:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the RCU protection and grace period for cad_pid (apply the patch or upgrade to a newer release).
  • Reboot the system after applying the kernel update to load the patched kernel and confirm services resume normally.
  • Optionally, run memory integrity or kernel OOM tests to ensure no lingering use‑after‑free conditions remain.
  • If an immediate update is not possible, restrict unprivileged users from accessing the cad_pid sysctl or disabling PID namespace creation until the patch is applied.

Generated by OpenCVE AI on September 25, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad_pid use-after-free race cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free. kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid(). At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race. Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side. call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list. Original KASAN crash stack: kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
Title reboot: fix cad_pid use-after-free race
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:22:51.720Z

Reserved: 2026-09-25T10:18:58.204Z

Link: CVE-2026-97938

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:21.193

Modified: 2026-09-25T11:17:21.193

Link: CVE-2026-97938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T18:30:17Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free