{"id":"CVE-2026-98899","kind":"vulnerability","aliases":["CVE-2026-98899"],"related":[],"title":"Linux kernel: ipset RCU locking fix in netfilter hash tables","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.","summary":"The Linux kernel's netfilter ipset code held RCU and spinlock sections in the wrong places when reference counters were updated during garbage collection. The sources describe a locking correction only and do not say what an attacker gains.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipset","linux","netfilter","self-hosted"],"not_affected_if":[],"how_to_check":"- `uname -r` to see the running kernel version, then compare against the fixed kernel in your distribution's advisory\n- `lsmod | grep ip_set` to check whether the ipset module is loaded at all","fix":"- Install the kernel update from your distribution or vendor that includes the ipset RCU locking fix, then reboot\n- unknown for the exact fixed kernel version, as the sources do not say","status":"open","published_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:59:55+00:00","updated_at":"2026-10-25T04:59:55+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T04:59:55Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel update from your distribution or vendor that includes the ipset RCU locking fix, then reboot\n- unknown for the exact fixed kernel version, as the sources do not say","reach":"local","title":"Linux kernel: ipset RCU locking fix in netfilter hash tables","impact":"medium","summary":"The Linux kernel's netfilter ipset code held RCU and spinlock sections in the wrong places when reference counters were updated during garbage collection. The sources describe a locking correction only and do not say what an attacker gains.","category":"infrastructure","nicknames":[],"who_cares":["linux","netfilter","ipset","self-hosted"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; the sources describe only a locking correction","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected version range, severity, and whether an unprivileged local user can reach the code path.","how_to_check":"- `uname -r` to see the running kernel version, then compare against the fixed kernel in your distribution's advisory\n- `lsmod | grep ip_set` to check whether the ipset module is loaded at all","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with netfilter ipset support, which is typical on firewalls and hosts that use ipset-based rules. The sources do not say which kernel versions are affected or whether a default configuration exposes the code path. unknown for who can safely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3329,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98899':13A,16A 'also':104C 'area':79C 'attack':61B 'bump':83C 'code':30B 'collect':47B 'correct':53B 'counter':42B,86C 'cve':11A,14A 'describ':50B 'disappear':103C 'fix':6A 'follow':68C 'gain':62B 'garbag':46B 'gc':111C 'hash':9A,99C 'held':31B 'host':23B 'infrastructur':17B 'ipset':3A,18B,29B,74C 'keep':92C 'kernel':2A,26B,66C 'linux':1A,19B,25B,65C 'lock':5A,52B,78C,95C,116C 'mark':75C 'mtype':110C 'need':90C,113C 'netfilt':8A,20B,28B,73C 'place':39B 'proper':80C 'rcu':4A,32B,77C,94C,115C 'reason':108C 'refer':41B,98C 'resolv':72C 'say':58B 'section':35B 'self':22B 'self-host':21B 'sourc':49B 'spinlock':34B,120C 'tabl':10A,100C 'updat':44B 'uref':85C 'vulner':69C 'wrong':38B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with netfilter ipset support, which is typical on firewalls and hosts that use ipset-based rules. The sources do not say which kernel versions are affected or whether a default configuration exposes the code path. unknown for who can safely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98899","severity":null,"published_at":"2026-10-23T12:18:23+00:00","modified_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}