All vulnerabilities
CVE-2026-98804

Linux: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0b105f4eb78e5ee39e5a74c47c9efd69b6ac849cFixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs.

Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.

Text from CVE List

Affected versions 8

  • Linuxaffected: fcc680a647ba77370480fe753664cc10d572b240 before f78d45d5f1ac4141a03f033141368671da4293e4CVE List
  • Linuxaffected: fcc680a647ba77370480fe753664cc10d572b240 before 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849cCVE List
  • Linuxaffected: fcc680a647ba77370480fe753664cc10d572b240 before bdea4980182e3badac74f04df6c07492b91c569eCVE List
  • Linuxaffected: 6.14CVE List
  • Linuxunaffected: all versions before 6.14CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3