CVE-2026-98260

The Linux kernel is vulnerable to a use-after-free condition during the execve() system call. When a non-leader thread executes, de_thread() reassigns the PID to a leader thread, but the per-thread CPU timer node remains queued on the original thread. If subsequent operations like exec_mmap() fai...

EUVD-2026-93188

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

Race condition

Race condition in the exitsignal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader...