Live › vulnerability › CVE-2026-98804
Go to dashboardA race in the Linux kernel's page pool recycling code can touch a pool's statistics after the pool has already been freed when it is being destroyed. The sources do not describe a demonstrated attacker outcome beyond memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel built with CONFIG_PAGE_POOL_STATS=y that use page pools, which mainly means network drivers on hosts that create and destroy pools during operation. Ordinary application servers without such drivers in use are unlikely to be exposed, but the sources do not confirm the exact driver list.
No product ranges from the sources yet.
uname -r and compare against the kernel build that carries the upstream fix from the NVD entryCONFIG_PAGE_POOL_STATS is set in the kernel config, for example grep PAGE_POOL_STATS /boot/config-$(uname -r)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs.
Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
This page as .md · .json · in your agent: get_signal("CVE-2026-98804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.