CVE-2026-98558
Received Received - Intake

Memory Leak in Linux Kernel Networking Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline, dev_cpu_dead() drains its softnet queues (completion_queue, output_queue, poll_list, process_queue, and input_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched. If oldcpu goes offline while holding pending skbs in its skb_defer_nodes lists (e.g. below the sysctl_skb_defer_max >> 1 IPI threshold, or if the IPI races with CPU teardown), those skbs remain stranded until oldcpu is brought back online. If any of these skbs hold page_pool fragments, page_pool_destroy() will stall indefinitely waiting for inflight pages to be returned when a netdev or driver is torn down while oldcpu is offline. Additionally, if smp_call_function_single_async() fails in kick_defer_list_purge() because the target CPU went offline, reset defer_ipi_scheduled to 0 so future IPI kicks are not blocked when the CPU comes back online. Also, if oldcpu was the last online CPU on its NUMA node, drain that node's slot across all CPUs so no skbs deferred from that node remain stranded on idle remote CPUs (or if the node itself is subsequently offlined). Finally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and whether the caller migrated CPUs after llist_add(), flushing the node list if so, to close the preemption TOCTOU race against CPU/node teardown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98558
EUVD
EUVD-2026-103603

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 68822bdf76f10c3dc80609d4e2cdc1e847429086
Linux Linux 68822bdf76f10c3dc80609d4e2cdc1e847429086
Linux Linux 5.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when a CPU goes offline while holding pending network packets in its skb_defer_nodes lists. These packets remain stranded until the CPU is brought back online. If the packets hold page fragments, it can cause indefinite stalls during system teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's handling of skb_defer_nodes during CPU offline events. Detection requires checking kernel logs for CPU offline events or stalled page_pool_destroy() calls. Monitor for warnings like 'page_pool_destroy stall' or 'skb_defer_nodes leak' in dmesg or system logs. No direct commands detect this, but watch for CPU hotplug events and page pool teardown delays.

Impact Analysis

If exploited, this could lead to system hangs or crashes during CPU hot-unplugging or network device teardown. It may cause performance degradation or denial of service in systems relying on CPU offline/online operations.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Avoid unnecessary CPU offline operations until patched. If CPU offline is required, ensure all network devices and drivers are stable before proceeding. Monitor system logs for stall conditions during page pool destruction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart