{"id":"CVE-2026-98804","kind":"vulnerability","aliases":["CVE-2026-98804"],"related":[],"title":"Linux kernel: page pool use-after-free when recycling network buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()\n\nWith CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates\nthe recycle stats after dropping the producer lock. If it just recycled\nthe last inflight netmems of a pool being destroyed, page_pool_release()\ncan pass its producer-lock barrier and free the pool before\nrecycle_stat_add() runs.\n\nCommit fcc680a647ba7 (\"page_pool: allow mixing PPs within one bulk\")\nmoved this stat update after the unlock. Commit 271683bb2cf32\n(\"page_pool: Fix use-after-free in page_pool_recycle_in_ring\") later\nadded the barrier, but only fixed page_pool_recycle_in_ring(). Move\nthe update back under the lock.","summary":"A race in the Linux kernel's page pool recycling code can touch a pool's statistics after the pool has already been freed when it is being destroyed. The sources do not describe a demonstrated attacker outcome beyond memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","network-drivers","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `uname -r` and compare against the kernel build that carries the upstream fix from the NVD entry\n- Check whether `CONFIG_PAGE_POOL_STATS` is set in the kernel config, for example `grep PAGE_POOL_STATS /boot/config-$(uname -r)`","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing page_pool_recycle_ring_bulk() (version unknown from the sources)\n- Reboot into the patched kernel after the package update","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:02+00:00","updated_at":"2026-10-25T05:15:02+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:15:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing page_pool_recycle_ring_bulk() (version unknown from the sources)\n- Reboot into the patched kernel after the package update","reach":"local","title":"Linux kernel: page pool use-after-free when recycling network buffers","impact":"high","summary":"A race in the Linux kernel's page pool recycling code can touch a pool's statistics after the pool has already been freed when it is being destroyed. The sources do not describe a demonstrated attacker outcome beyond memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted","network-drivers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free, possibly crash or privilege escalation","analyst_note":"Check the NVD entry and the linked kernel.org stable commit for the fixed kernel versions and the exact trigger conditions.","how_to_check":"- Run `uname -r` and compare against the kernel build that carries the upstream fix from the NVD entry\n- Check whether `CONFIG_PAGE_POOL_STATS` is set in the kernel config, for example `grep PAGE_POOL_STATS /boot/config-$(uname -r)`","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only systems running a Linux kernel built with CONFIG_PAGE_POOL_STATS=y that use page pools, which mainly means network drivers on hosts that create and destroy pools during operation. Ordinary application servers without such drivers in use are unlikely to be exposed, but the sources do not confirm the exact driver list.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3515,"output_tokens":627,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98804':15A,18A '271683bb2cf32':163C 'add':143C,178C 'allow':149C 'alreadi':49B 'attack':64B 'back':192C 'barrier':135C,180C 'beyond':66B 'buffer':12A 'bulk':92C,103C,154C 'code':38B 'commit':145C,162C 'config':94C 'corrupt':68B 'cve':13A,16A 'demonstr':63B 'describ':61B 'destroy':56B,125C 'driver':23B 'drop':109C 'fcc680a647ba7':146C 'fix':82C,166C,183C 'follow':74C 'free':8A,86C,137C,170C 'freed':51B 'host':27B 'inflight':119C 'kernel':2A,19B,33B,72C 'last':118C 'later':177C 'linux':1A,20B,32B,71C 'lock':112C,134C,195C 'memori':67B 'mix':150C 'move':155C,189C 'net':79C 'netmem':120C 'network':11A,22B 'network-driv':21B 'one':153C 'outcom':65B 'page':3A,35B,80C,88C,95C,99C,126C,147C,164C,172C,184C 'pass':130C 'pool':4A,36B,42B,47B,81C,89C,96C,100C,123C,127C,139C,148C,165C,173C,185C 'pps':151C 'produc':111C,133C 'producer-lock':132C 'race':29B 'recycl':10A,37B,90C,101C,106C,116C,141C,174C,186C 'releas':128C 'resolv':78C 'ring':91C,102C,176C,188C 'run':144C 'runtim':24B 'self':26B 'self-host':25B 'sourc':58B 'stat':97C,107C,142C,157C 'statist':44B 'touch':40B 'unlock':161C 'updat':104C,158C,191C 'use':6A,84C,168C 'use-after-fre':5A,83C,167C 'vulner':75C 'within':152C 'y':98C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel built with CONFIG_PAGE_POOL_STATS=y that use page pools, which mainly means network drivers on hosts that create and destroy pools during operation. Ordinary application servers without such drivers in use are unlikely to be exposed, but the sources do not confirm the exact driver list.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98804","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}