CVE-2026-98804
In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
Affected versions
Linux kernel versions
6.14
and later are affected. Fixed in
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-98804?
CVE-2026-98804 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.14 onward and has been patched in 6.18.56, 7.2.10 and 7.3. CVE-2026-98804 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98804?
Yes. CVE-2026-98804 has been patched. Fixed versions include 6.18.56, 7.2.10 and 7.3. If you are running Linux kernel 6.14 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98804 actively exploited?
No. CVE-2026-98804 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.