---
id: CVE-2026-97938
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  reboot: fix cad_pid use-after-free race

  cad_pid is a single kernel-wide struct pid pointer
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  reboot: fix cad_pid use-after-free race

  cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
  reads it and passes it to pid_vnr() without protecting th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    ad72e2566643fff7f01666d845fb026898155e1f
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    9a17b0e053197a6a42cdc75e75a35b17aa662088
  - >-
    Linux >= 9ec52099e4b8678a60e9f93e41ad87885d64f3e6 <
    5a88f78df753993469dab4d1831f8fb4256a9468
  - Linux 2.6.19
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:21.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97938'
references:
  - url: 'https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.883Z'
epss: 0.00198
epssPercentile: 0.08619
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

reboot: fix cad_pid use-after-free race

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.