CVE-2026-98286

drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

Published Oct 6, 2026 CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

In drop_monitor teardown paths (net_dm_trace_off_set(),
net_dm_hw_monitor_stop(), and error unwind paths in net_dm_trace_on_set()
and net_dm_hw_monitor_start()), per-CPU timers are stopped using
timer_delete_sync() followed by cancel_work_sync().

However, there is a circular dependency between send_timer and
dm_alert_work:
1) sched_send_work() (timer callback) schedules dm_alert_work.
2) send_dm_alert() / net_dm_hw_summary_work() calls reset_per_cpu_data()
or net_dm_hw_reset_per_cpu_data().
3) If memory allocation fails under memory pressure in the reset
function, it re-arms the timer via mod_timer(&data->send_timer, ...).

If dm_alert_work is running concurrently while timer_delete_sync()
executes on another CPU, an allocation failure in the worker will
re-arm the timer after timer_delete_sync() has already returned.
Once cancel_work_sync() completes and module_put() is called, the timer
remains active in the timer wheel. If the module is then unloaded, the
timer will fire and execute sched_send_work() in freed memory,
triggering a kernel panic / use-after-free.

Switch from timer_delete_sync() to timer_shutdown_sync(). This guarantees
that any in-flight timer handler has finished and prevents subsequent
re-arming attempts from running workers from succeeding. When monitoring
is restarted later, timer_setup() is invoked, which cleanly
re-initializes the timer.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9398e9c0b1d44eeb700e9e766c02bcc765c82570`	affected	< 9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e
`9398e9c0b1d44eeb700e9e766c02bcc765c82570`	affected	< bda4d9525fb91a2388ee09669421b8d505290864
`9398e9c0b1d44eeb700e9e766c02bcc765c82570`	affected	< c391a40f71886b28c082b47270f0e856fa3e1150
`2514c7ad115e762562c7bdd58bb1ab3425a98245`	affected	—
`439b1164da3612ec7e186e1dc314471e7190bfc7`	affected	—
`5.10.27`	affected	< 5.11
`5.11.11`	affected	< 5.12

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[9398e9c0b1d44eeb700e9e766c02bcc765c82570,9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e)`	affected	code_commit	—
`[9398e9c0b1d44eeb700e9e766c02bcc765c82570,bda4d9525fb91a2388ee09669421b8d505290864)`	affected	code_commit	—
`[9398e9c0b1d44eeb700e9e766c02bcc765c82570,c391a40f71886b28c082b47270f0e856fa3e1150)`	affected	code_commit	—
`2514c7ad115e762562c7bdd58bb1ab3425a98245`	affected	code_commit	—
`439b1164da3612ec7e186e1dc314471e7190bfc7`	affected	code_commit	—
`[5.10.27,5.11)`	affected	semver	—
`[5.11.11,5.12)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.12`	affected	generic	—
`[0,5.12)`	unaffected	generic	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.166% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98286.mbox
https://git.kernel.org/stable/c/9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e
https://git.kernel.org/stable/c/bda4d9525fb91a2388ee09669421b8d505290864
https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150
https://nvd.nist.gov/vuln/detail/CVE-2026-98286
https://www.cve.org/CVERecord?id=CVE-2026-98286

History

Oct 11, 2026 4:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Oct 11, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98286.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98286 https://www.cve.org/CVERecord?id=CVE-2026-98286
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Oct 7, 2026 4:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Oct 6, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Oct 6, 2026 1:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Oct 6, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown In drop_monitor teardown paths (net_dm_trace_off_set(), net_dm_hw_monitor_stop(), and error unwind paths in net_dm_trace_on_set() and net_dm_hw_monitor_start()), per-CPU timers are stopped using timer_delete_sync() followed by cancel_work_sync(). However, there is a circular dependency between send_timer and dm_alert_work: 1) sched_send_work() (timer callback) schedules dm_alert_work. 2) send_dm_alert() / net_dm_hw_summary_work() calls reset_per_cpu_data() or net_dm_hw_reset_per_cpu_data(). 3) If memory allocation fails under memory pressure in the reset function, it re-arms the timer via mod_timer(&data->send_timer, ...). If dm_alert_work is running concurrently while timer_delete_sync() executes on another CPU, an allocation failure in the worker will re-arm the timer after timer_delete_sync() has already returned. Once cancel_work_sync() completes and module_put() is called, the timer remains active in the timer wheel. If the module is then unloaded, the timer will fire and execute sched_send_work() in freed memory, triggering a kernel panic / use-after-free. Switch from timer_delete_sync() to timer_shutdown_sync(). This guarantees that any in-flight timer handler has finished and prevents subsequent re-arming attempts from running workers from succeeding. When monitoring is restarted later, timer_setup() is invoked, which cleanly re-initializes the timer.
Title		drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e https://git.kernel.org/stable/c/bda4d9525fb91a2388ee09669421b8d505290864 https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150