CVE-2026-98804
Received Received - Intake

Use-After-Free in Linux Kernel Page Pool

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98804
EUVD
EUVD-2026-103889

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux fcc680a647ba77370480fe753664cc10d572b240
Linux Linux fcc680a647ba77370480fe753664cc10d572b240
Linux Linux fcc680a647ba77370480fe753664cc10d572b240
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's page_pool subsystem. It occurs when CONFIG_PAGE_POOL_STATS is enabled. The issue happens in page_pool_recycle_ring_bulk() where statistics updates are performed after releasing a lock. If the last network memory buffers are recycled during pool destruction, the pool may be freed before the stats update completes, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's page_pool implementation and requires kernel-level detection. Check if your kernel version includes the vulnerable code path by examining the kernel source or running uname -a to identify the kernel version. Look for CONFIG_PAGE_POOL_STATS=y in your kernel configuration.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Systems using affected Linux kernel versions with CONFIG_PAGE_POOL_STATS enabled may experience instability or security breaches through malicious network traffic triggering the use-after-free condition.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. If patching is not immediately possible, disable CONFIG_PAGE_POOL_STATS in your kernel configuration and rebuild the kernel. Monitor kernel security advisories for updates and consider isolating systems running vulnerable kernels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart