Use-after-free in Linux kernel - CVE-2026-98198
Published: October 7, 2026
Vulnerability identifier: #VU153819
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98198
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to use-after-free in the pwm-fan driver's sample_timer() callback when detaching the driver while the RPM timer is active. A local user can trigger driver detachment during a timer expiry window to corrupt kernel memory.
The callback accesses device-managed tachometer arrays that can be freed before timer cleanup occurs. The callback can also rearm the RPM timer.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98198
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1