CVE-2026-97938

Executive Summary

CVE-2026-97938 is a use-after-free race condition in the Linux kernel's cad_pid handling, affecting the reboot sysctl interface. The flaw allows a concurrent writer to replace the single kernel-wide cad_pid struct pid pointer and drop the final reference to the old structure while a reader (proc_do_cad_pid() or kill_cad_pid()) is still dereferencing it. At the time of reporting, an unprivileged user could reach the vulnerable sysctl through user and PID namespaces because cad_pid was registered in pid_table[]; this namespace and permission mismatch has been corrected by moving cad_pid back to the global reboot sysctl table, but that change does not fix the underlying lifetime race. CVSS score and CWE are not assigned in the provided data, though the weakness class is a use-after-free (CWE-416).

Technical Analysis

The core defect is a missing lifetime guarantee on cad_pid, described as "a single kernel-wide struct pid pointer." Two read sites are affected:

1. proc_do_cad_pid() — reads cad_pid and passes it to pid_vnr() without protecting the referenced struct pid lifetime.
2. kill_cad_pid() — passes cad_pid to kill_pid() with the same lifetime race.

In both cases, a concurrent writer can replace cad_pid, drop the final reference to the old struct pid, and thereby free that object after the reader has loaded the pointer but before pid_vnr()/kill_pid() has finished dereferencing it. This is a classic time-of-check/time-of-use (TOCTOU) lifetime race producing a use-after-free.

The original KASAN crash stack confirms the dereference path:

kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

The memory corruption is specifically the read of pid->level inside pid_nr_ns() after the struct pid has been freed. This is a read-after-free leading to an invalid type/value dereference — in a kernel context, this can be weaponized for information disclosure, denial of service, or memory corruption depending on allocator state and heap grooming.

Two important structural details from the description:

• Namespace exposure: cad_pid was registered in pid_table[], making the sysctl reachable through user and PID namespaces. This allowed an unprivileged user to reach the sysctl, which is a namespace and permission mismatch. Moving cad_pid back to the global reboot sysctl table corrected the exposure but did not fix the race.
• Fix constraint: The naive fix of call_rcu(&old_pid->rcu, ...) is explicitly unsuitable because free_pid() also queues pid->rcu. Queueing the same rcu_head twice can corrupt the RCU callback list. The described resolution instead treats cad_pid as an RCU-protected pointer at both read sites and waits for a grace period before dropping the old reference on the write side.

No concrete function beyond those named in the NVD description (e.g., proc_do_cad_pid(), kill_cad_pid(), pid_vnr(), pid_nr_ns(), kill_pid(), free_pid()) should be assumed. No file paths, endpoints, or parameters other than those cited are known.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None, Nuclei template: NO, Exploit code: NO). The chain below is inferred strictly from the vulnerability class (use-after-free via race) and the details in the NVD description.

1. Reconnaissance / target identification: Identify a Linux kernel instance with the vulnerable cad_pid handling. Because the description states cad_pid was registered in pid_table[] at report time, an unprivileged local user with access to the relevant user and PID namespace could reach the sysctl. The attacker needs local code execution in an appropriate namespace context.

2. Triggering the flaw class: The attacker races the read and write paths against cad_pid. A reader invokes proc_do_cad_pid() (which calls pid_vnr(cad_pid)) or kill_cad_pid() (which calls kill_pid()), while a concurrent writer replaces cad_pid and drops the final reference to the prior struct pid. If the writer frees the old structure after the reader has loaded the pointer but before pid_vnr()/kill_pid() finishes dereferencing it, pid_nr_ns() reads the freed pid->level — the use-after-free.

3. Payload / execution method at the vulnerability-class level: This is a kernel use-after-free. The exploitation primitive is a dangling struct pid reference. An attacker typically aims to win the race window and then influence reclaim of the freed object (heap grooming/spraying) so the dereferenced fields are attacker-influenced. Due to the RCU callback-list corruption constraint noted in the fix, the attacker cannot rely on a simple double-call_rcu behavior; the described defect is at the read site, not a double-queue. No specific payload or code pattern is derivable from the provided data — "No public PoC available; attack chain is inferred from vulnerability class."

4. Post-exploitation impact: Successful exploitation of a kernel use-after-free can yield denial of service (kernel crash, as demonstrated by the KASAN report), information disclosure, or, under suitable heap conditions, privilege escalation in kernel context. The description only confirms the memory-safety violation and crash; elevated-impact outcomes are class-inferred and not established by the provided data.

Impact Assessment

Affected systems are Linux kernel hosts with the vulnerable cad_pid handling. Because cad_pid is a "single kernel-wide struct pid pointer," the race surface is system-wide within the affected kernel, though the namespace registration detail means the practical reachability depends on namespace and permission configuration at the time of the report.

No CVSS score or vector is assigned in the provided data (CVSS: N/A), so subscore reference is unavailable. No EPSS score has been published by FIRST.org, and this CVE is not in CISA KEV. No affected version list or OSV package mapping is available.

Blast radius considerations:

• Availability: The KASAN-confirmed outcome is a kernel crash, i.e., potential denial of service.
• Confidentiality/Integrity: A use-after-free read of pid->level can disclose stale kernel memory or, under controlled heap reuse, enable further primitives. These are class-level inferences, not confirmed by the advisory.
• Privilege boundary: At report time an unprivileged user could reach the sysctl through user and PID namespaces, lowering the required attacker position; the namespace fix reduces this exposure but leaves the race in place.

Detection Guidance

Detection focuses on kernel memory-safety telemetry, crash signatures, and anomalous access to reboot/cad_pid sysctls. No exploit-specific network signatures are known, so network rules are necessarily generic and will produce lower fidelity.

Sigma Rule

title: Potential Linux cad_pid Use-After-Free Race Exploitation Indicator
id: 8f3c1a2e-9b74-4d61-a0c5-2e7d4b9f1a30
status: experimental
description: Detects kernel KASAN or crash signatures referencing pid_nr_ns, pid_vnr, or proc_do_cad_pid, consistent with CVE-2026-97938 use-after-free race on cad_pid.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97938
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_kasan:
    message|contains:
      - 'KASAN'
      - 'use-after-free'
  selection_funcs:
    message|contains:
      - 'pid_nr_ns'
      - 'pid_vnr'
      - 'proc_do_cad_pid'
      - 'kill_cad_pid'
  condition: selection_kasan and selection_funcs
falsepositives:
  - Legitimate kernel testing with KASAN enabled
  - Other kernel bugs touching the same symbols
level: high

YARA Rule

rule CVE_2026_97938_cad_pid_uaf_indicator
{
    meta:
        description = "Detects crash/KASAN log artifacts referencing cad_pid use-after-free race (CVE-2026-97938)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97938"
        date = "2026-01-01"
    strings:
        $s1 = "proc_do_cad_pid" ascii
        $s2 = "kill_cad_pid" ascii
        $s3 = "pid_nr_ns" ascii
        $s4 = "pid_vnr" ascii
        $s5 = "use-after-free" ascii nocase
        $s6 = "cad_pid" ascii
    condition:
        uint32(0) == 0x464c457f or
        (2 of ($s1, $s2, $s3, $s4, $s5)) or
        ($s6 and $s5)
}

Suricata IDS Rule

No network protocol signature is specific to this local kernel race. This rule is a low-fidelity placeholder keyed to the CVE identifier appearing in traffic (e.g., vulnerability scanner traffic); it does not detect the memory race itself.

alert http any any -> any any (msg:"CVE-2026-97938 Linux kernel cad_pid use-after-free race reference observed"; flow:established,to_server; content:"CVE-2026-97938"; http_header; nocase; classtype:attempted-recon; sid:90097938; rev:1;)

Elastic Detection

process where host.os.type == "linux" and
  (
    process.name in ("dmesg", "journalctl") and
    process.args : "*cad_pid*"
  ) or
  (
    event.category == "process" and
    process.command_line : "*cad_pid*"
  )

Splunk SPL Query

index=linux_syslog OR index=os_logs (source="*kernel*" OR source="*dmesg*")
| search ("use-after-free" OR "KASAN" OR "pid_nr_ns" OR "pid_vnr" OR "proc_do_cad_pid" OR "kill_cad_pid")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-97938">
  <rule id="100979" level="12">
    <decoded_as>syslog</decoded_as>
    <match>use-after-free</match>
    <match>cad_pid|pid_nr_ns|pid_vnr|proc_do_cad_pid|kill_cad_pid</match>
    <description>CVE-2026-97938: Possible Linux cad_pid use-after-free race (kernel crash/KASAN indicator)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version mapping is available from the tracked data.

1. Immediate mitigations

   • Restrict access to the reboot sysctl interface. The advisory notes cad_pid was registered in pid_table[], allowing unprivileged access through user and PID namespaces; ensuring cad_pid is exposed only via the global reboot sysctl table prevents namespace-based unprivileged reach. Confirm your kernel already reflects that namespace correction.
   • Limit untrusted local code execution and unprivileged user/PID namespace creation (e.g., via user namespace restrictions) to reduce the number of potential racers.
   • Enable KASAN or equivalent runtime memory-safety instrumentation on high-value hosts where feasible to detect and capture crash evidence.

2. Patch/upgrade steps

   • Apply the upstream fix when available. Per the description, the correct fix treats cad_pid as an RCU-protected pointer at both read sites and waits for a grace period before dropping the old reference on the write side.
   • Do not implement the fix via call_rcu(&old_pid->rcu, ...); because free_pid() also queues pid->rcu, queueing the same rcu_head twice can corrupt the RCU callback list.
   • Track your Linux distribution's kernel advisory for the corresponding backport; no specific commit hash or version is available in the provided data.

3. Long-term hardening

   • Keep kernel patch levels current and monitor kernel memory-safety fixes relevant to PID lifecycle handling.
   • Constrain unprivileged namespace creation where not operationally required.
   • Maintain kernel crash telemetry (dmesg/KASAN/pstore) and centralize it for detection.

References

• NVD — CVE-2026-97938: https://nvd.nist.gov/vuln/detail/CVE-2026-97938
• Linux kernel reboot/cad_pid fix description as provided in the NVD entry (RCU-protected cad_pid at read sites; grace period before dropping old reference on write side)
• Upstream Linux kernel PID/sysctl subsystem documentation and source (kernel/pid.c, sysctl handling of reboot parameters) — consult your distribution's kernel source for the specific backport
• CWE-416: Use After Free — https://cwe.mitre.org/data/definitions/416.html
• FIRST.org EPSS (not yet scored for this CVE) — https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, PoC, or CISA KEV listing were identified in the provided data.