I’m wondering whether a fix for CVE-2026-98260, the POSIX CPU timer use-after-free vulnerability disclosed as part of InfinityCore, is already being worked on for AlmaLinux 9.8.
We’re running an HPC cluster with AlmaLinux 9.8 and currently use kernel 5.14.0-687.57.1.el9_8.
I inspected the corresponding kernel source RPM and found that begin_new_exec() still calls posix_cpu_timers_exit() and exit_itimers() after unshare_files() and exec_mmap(), which appears to match the vulnerable code path. I haven’t yet verified the fully patched RPM build sources, though.
There is also a public exploit available, although it targets Ubuntu and hasn’t been demonstrated on AlmaLinux as far as I know.
We’re considering building our own patched kernel in the meantime, but would obviously prefer an official AlmaLinux update.
That is, neither of the RHEL that AlmaLinux 9 and 10 are compatible with, do have a fix yet. Whether AlmaLinux can release earlier than RHEL depends on where the fix can be sourced from. Presumably.
Yes, no “CVE-2026-98260” in the changelog yet (although that is no proof of lack):
$ rpm -q --changelog kernel-5.14.0-687.57.1.el9_8.x86_64 | grep CVE-2026-9
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417}
- futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003}