Live › vulnerability › CVE-2026-98899
Go to dashboardThe Linux kernel's netfilter ipset code held RCU and spinlock sections in the wrong places when reference counters were updated during garbage collection. The sources describe a locking correction only and do not say what an attacker gains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with netfilter ipset support, which is typical on firewalls and hosts that use ipset-based rules. The sources do not say which kernel versions are affected or whether a default configuration exposes the code path. unknown for who can safely skip it.
No product ranges from the sources yet.
uname -r to see the running kernel version, then compare against the fixed kernel in your distribution's advisorylsmod | grep ip_set to check whether the ipset module is loaded at allEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: mark the rcu locked areas properly
When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
This page as .md · .json · in your agent: get_signal("CVE-2026-98899")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.