All vulnerabilities
CVE-2026-97901

Linux: genetlink: pin family module during policy dump

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1a345d95e59a99e25404138b5a1ec2edcb03269fAlso 6e4d746e55c83c240cffce92356763d16b236af5, 508387ad95ef9c13aa6431678c39763e882da2dc and 2 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1a345d95e59a99e25404138b5a1ec2edcb03269fLinuxCVE List
  • 6e4d746e55c83c240cffce92356763d16b236af5LinuxCVE List
  • 508387ad95ef9c13aa6431678c39763e882da2dcLinuxCVE List
  • 6d8e653fcf1c90310797eeba8e5fafe9ccc3de9eLinuxCVE List
  • 6a1094c34d176827b2b173e163dcc964a13af93fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

genetlink: pin family module during policy dump

The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and remain pending after the initial request.

Netlink pins the module which owns the dump callback, but in this case that is the controller's owner rather than the target family's owner. The target family can consequently be unregistered and its module unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module.

Take a reference to the target family's module when the dump starts. Drop it from the error and done paths. This matches the lifetime for which the dump context retains the family and policy pointers.

Text from CVE List

Affected versions 12

  • Linuxaffected: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 before 1a345d95e59a99e25404138b5a1ec2edcb03269fCVE List
  • Linuxaffected: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 before 6e4d746e55c83c240cffce92356763d16b236af5CVE List
  • Linuxaffected: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 before 508387ad95ef9c13aa6431678c39763e882da2dcCVE List
  • Linuxaffected: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 before 6d8e653fcf1c90310797eeba8e5fafe9ccc3de9eCVE List
  • Linuxaffected: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 before 6a1094c34d176827b2b173e163dcc964a13af93fCVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5