CVE-2026-98198
N/AIn the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms the RPM timer and accesses the devm-managed ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action which stops the timer is registered before those arrays are allocated. Since devres releases entries in reverse order, driver detach can free the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry in that window accesses the freed tach data. With a KASAN kernel, a test-only kprobe delayed entry to pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs reported three four-byte reads and two four-byte writes in sample_timer() after its backing devm allocations had been freed. The helper did not invoke the timer callback, cleanup actions or free functions. With the fix, three matching unbind runs completed without KASAN, BUG, WARNING, Oops or panic. Instrumentation confirmed that timer retirement completed before the first timer backing allocation was released. Split timer retirement from the power cleanup and register its devres action after the timer backing data and IRQ actions are installed. This preserves the early power rollback action while ensuring the timer is retired before its backing data is released. Use timer_shutdown_sync() because the callback can rearm itself.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
References and research data (JSON)
Vendor product assessments
Showing 32 of 277 vendor product statements; 245 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
python3-perf as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-perf
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-cross-headers as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-cross-headers
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-kvm
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-debug-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-partner
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-zfcpdump-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00bpftool as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-debug as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-modules-internal
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-rt-modules as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-tools as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00kernel-zfcpdump-modules as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-modules
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8
Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98198.json Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93126 EUVD · EUVD-2026-93126
Technical & other
- https://git.kernel.org/stable/c/d073d306e587c1f35aaf9c07c42e54a3d5895d8fCVE record · Linux · Updated 2026-10-21T12:54:52.698Z
NVD · CVE-2026-98198 · Updated 2026-10-21T13:21:25.537 - https://git.kernel.org/stable/c/1e824fdb14a187ce56697e803b02b1e86243a755CVE record · Linux · Updated 2026-10-21T12:54:52.698Z
NVD · CVE-2026-98198 · Updated 2026-10-21T13:21:25.537 - https://git.kernel.org/stable/c/a5ce3fe5335a24d0220958c6866830a6d5fa1cc0CVE record · Linux · Updated 2026-10-21T12:54:52.698Z
NVD · CVE-2026-98198 · Updated 2026-10-21T13:21:25.537 - https://git.kernel.org/stable/c/b48339b0a577783e4590a69e4cd2f2760ce33154CVE record · Linux · Updated 2026-10-21T12:54:52.698Z
NVD · CVE-2026-98198 · Updated 2026-10-21T13:21:25.537 - https://git.kernel.org/stable/c/26d5ff79768548efb1e604bb6e8697c101e06269CVE record · Linux · Updated 2026-10-21T12:54:52.698Z
NVD · CVE-2026-98198 · Updated 2026-10-21T13:21:25.537 - https://access.redhat.com/security/cve/CVE-2026-98198 Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2546406 Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-98198 Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-98198 Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98198.mbox Red Hat · CVE-2026-98198 · Updated 2026-10-17T22:02:43+00:00