Description
In the Linux kernel, the following vulnerability has been resolved:

reboot: fix cad_pid use-after-free race

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level
kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()
kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
Published: 2026-09-25
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: Kernel-Level Use-After-Free
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free race on the kernel‑wide cad_pid pointer. An unprivileged user can trigger the race via sysctl calls in user and PID namespaces. When a writer replaces cad_pid while a reader is accessing it, the freed pointer can be dereferenced by pid_vnr or kill_pid, leading to memory corruption and a kernel crash. The weakness is a race condition leading to memory corruption (CWE-825).

Affected Systems

This issue affects the Linux kernel. Any kernel build containing the cad_pid pointer race before the fix is vulnerable. Version information is not specified, but the problem existed in earlier kernel releases that did not incorporate the RCU protection and grace‑period fix.

Risk and Exploitability

The EPSS score is <1%, indicating a low probability of exploitation. The vulnerability is not listed in KEV. The CVSS score of 7.0 signifies a moderate severity. The vulnerability is exploitable from a local, unprivileged user context that can manipulate sysctl settings or create PID namespaces. The primary consequence is a kernel crash due to memory corruption. No public exploits are known, yet the presence of a kernel-level use‑after‑free warrants immediate remediation.

Generated by OpenCVE AI on October 1, 2026 at 09:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the RCU protection and grace period for cad_pid (apply the patch or upgrade to a newer release).
  • Reboot the system after applying the kernel update to load the patched kernel and confirm services resume normally.
  • Optionally, run memory integrity or kernel OOM tests to ensure no lingering use‑after‑free conditions remain.
  • If an immediate update is not possible, restrict unprivileged users from accessing the cad_pid sysctl or disabling PID namespace creation until the patch is applied.

Generated by OpenCVE AI on October 1, 2026 at 09:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6568-1 linux security update
History

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
References

Sat, 03 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad_pid use-after-free race cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free. kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid(). At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race. Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side. call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list. Original KASAN crash stack: kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
Title reboot: fix cad_pid use-after-free race
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-21T12:53:45.385Z

Reserved: 2026-09-25T10:18:58.204Z

Link: CVE-2026-97938

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:21.193

Modified: 2026-10-21T13:21:16.970

Link: CVE-2026-97938

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97938 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T09:15:06Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference