All vulnerabilities
CVE-2026-98899

Linux: netfilter: ipset: mark the rcu locked areas properly

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in67bd3d2350d17c2f4fb158c3f917c10b15ecbc94Also 892399abd1a005a455d5b74d86d82b9773405f2b, 0c46c9ce24130657ec7460c27fba5d445f5abd06 and 7 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94LinuxCVE List
  • 892399abd1a005a455d5b74d86d82b9773405f2bLinuxCVE List
  • 0c46c9ce24130657ec7460c27fba5d445f5abd06LinuxCVE List
  • 5d0c22e73656d050daffad10a2ba8765ce8441c8LinuxCVE List
  • 5.10.271LinuxCVE List
  • 5.15.222LinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.

Text from CVE List

Affected versions 20

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 892399abd1a005a455d5b74d86d82b9773405f2bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before eee5172741b2c0e73210020732043e5d589295d3CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ecb48c6b9edc78de8dd456c365727ae14b88c1eeCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 0c46c9ce24130657ec7460c27fba5d445f5abd06CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ca9fab1ca15534cef1630e81a479e94b3bbcdb6aCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5d0c22e73656d050daffad10a2ba8765ce8441c8CVE List
  • Linuxaffected: all versions before 5.10.271CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7