---
id: CVE-2026-97938
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  reboot: fix cad_pid use-after-free race

  cad_pid is a single kernel-wide struct pid pointer
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  reboot: fix cad_pid use-after-free race

  cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
  reads it and passes it to pid_vnr() without protecting th…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-825
  - CWE-416
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    ae3e53fe3c1241855e3a88f74877738349948c78
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    ad72e2566643fff7f01666d845fb026898155e1f
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    9a17b0e053197a6a42cdc75e75a35b17aa662088
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    5a88f78df753993469dab4d1831f8fb4256a9468
  - Linux 2.6.19
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:19.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97938'
references:
  - url: 'https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97938.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97938'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541188'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97938'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97938'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97938.mbox
  - url: 'https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-97938'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10585
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.883Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

reboot: fix cad_pid use-after-free race

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97938.json)