# exec: do_close_on_exec() before taking exec_update_lock

CVE record · `CVE-2026-98388`

- **Identifiers:** `CVE-2026-98388`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 14 Oct 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 14 Oct 2026, 13:25 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `ae1e630bcaac739f625822078edbaea98366930d to before 955973fff4a36d39a848b00cac1706863f568fe1` (git)
  - affected: `d54f14655fd7d7b293698a8b6918563c4c0465e7 to before 550feab5b01000ab314868b62211fb3ddfd600e8` (git)
  - affected: `bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9 to before 5aacc19ba2b1faf84c4a2f2cf9a1784e03d1ff38` (git)
  - affected: `7456ae990a9738962b33146916fabca62ae3d4e0 to before 3feb4020bfb7ccf0d347f27051639d25e19cd65d` (git)
  - affected: `4bfe8c481846cee52473a2f7d7b30ee8e6749fc4 to before 0d86cd6b709c39216e6ee5ea8f0fc4242bbb2b53` (git)
  - affected: `f9b4b03ccc9c69bf7f7298d4559906ebea7143b3 to before 19ddef61ee0a49782a60f8f497e50597ad5de2da` (git)
  - affected: `6650527444dadc63d84aa939d14ecba4fadb2f69 to before 63be3d8511bdafa095cd14a393cbf3c58dbbb928` (git)
  - affected: `6650527444dadc63d84aa939d14ecba4fadb2f69 to before e780259b54e618ceb4763fbc21314acf3565e813` (git)
  - affected: `c1cfd63326f5d09999134e9052c353faf738286e` (git)
  - affected: `5.10.261 to before 5.10.271` (semver)
  - affected: `5.15.212 to before 5.15.222` (semver)
  - affected: `6.1.178 to before 6.1.189` (semver)
  - and 4 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `7.2`
  - unaffected: `before 7.2` (semver)
  - unaffected: `5.10.271 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.222 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.189 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.158 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.111 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.53 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.7 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 12th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 14 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-98388](https://www.cve.org/CVERecord?id=CVE-2026-98388)
- [NVD: CVE-2026-98388](https://nvd.nist.gov/vuln/detail/CVE-2026-98388)

### References from the CNA

- <https://git.kernel.org/stable/c/955973fff4a36d39a848b00cac1706863f568fe1>
- <https://git.kernel.org/stable/c/550feab5b01000ab314868b62211fb3ddfd600e8>
- <https://git.kernel.org/stable/c/5aacc19ba2b1faf84c4a2f2cf9a1784e03d1ff38>
- <https://git.kernel.org/stable/c/3feb4020bfb7ccf0d347f27051639d25e19cd65d>
- <https://git.kernel.org/stable/c/0d86cd6b709c39216e6ee5ea8f0fc4242bbb2b53>
- <https://git.kernel.org/stable/c/19ddef61ee0a49782a60f8f497e50597ad5de2da>
- <https://git.kernel.org/stable/c/63be3d8511bdafa095cd14a393cbf3c58dbbb928>
- <https://git.kernel.org/stable/c/e780259b54e618ceb4763fbc21314acf3565e813>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-98388>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-98388/>. Everything for agents: <https://agentprime.io/llms.txt>.