{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97903 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97903 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97903 and fix it if it is affected.\n\nWhat it is: CVE-2026-97903 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97903 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97903/ (Markdown: https://insights.sbomify.com/CVE-2026-97903/index.md)","id":"CVE-2026-97903","markdown":"https://insights.sbomify.com/CVE-2026-97903/index.md","name":"CVE-2026-97903","record":{"aliases":["BELL-CVE-2026-97903","DEBIAN-CVE-2026-97903","GHSA-cpwj-27c2-jfgq","UBUNTU-CVE-2026-97903"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel allows an unprivileged user to trigger a use-after-free in proc_flush_pid, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid-\u003einodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p-\u003ethread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"exit: hold a reference to thread_pid across proc_flush_pid","id":"CVE-2026-97903","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"cpufreq: initialize policy rwsem before sysfs publication","id":"CVE-2026-97904"},"packages":[],"prev":{"headline":"fs: don't return -EINVAL for successful nested thaw","id":"CVE-2026-97902"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel allows an unprivileged user to trigger a use-after-free in proc_flush_pid, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-97903/"}