---
id: "CVE-2026-98899"
kind: "vulnerability"
aliases: ["CVE-2026-98899"]
title: "Linux kernel: ipset RCU locking fix in netfilter hash tables"
severity: "unknown"
cvss: null
epss: 0.00215
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "ipset", "linux", "netfilter", "self-hosted"]
not_affected_if: []
published_at: "2026-10-23T12:18:23+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98899", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98899", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: ipset RCU locking fix in netfilter hash tables

The Linux kernel's netfilter ipset code held RCU and spinlock sections in the wrong places when reference counters were updated during garbage collection. The sources describe a locking correction only and do not say what an attacker gains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version, then compare against the fixed kernel in your distribution's advisory
- `lsmod | grep ip_set` to check whether the ipset module is loaded at all

## Fix

- Install the kernel update from your distribution or vendor that includes the ipset RCU locking fix, then reboot
- unknown for the exact fixed kernel version, as the sources do not say

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98899
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98899

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep
the rcu lock because the referred hash table can't
disappear. Also, from the same reason in mtype_gc we
need the rcu lock and not a spinlock.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_