{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98899", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.379Z", "datePublished": "2026-10-23T11:54:09.249Z", "dateUpdated": "2026-10-24T14:09:30.135Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:30.135Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker must send local NETLINK_NETFILTER IPSET_CMD_CREATE/ADD messages: ip_set_create() starts timeout GC, while ip_set_uadd()->ip_set_ad()->call_ad()->mtype_add() triggers mtype_resize(). Received packets cannot invoke the userspace-only resize path.\nAC:L - The same attacker chooses IPSET_ATTR_TIMEOUT, INITVAL, BUCKETSIZE, and colliding elements, repeatedly causing scheduled mtype_gc() to race attacker-triggered mtype_resize(); no victim-controlled state or hardware failure is required.\nPR:L - nfnetlink_rcv() requires netlink_net_capable(skb, CAP_NET_ADMIN), but this checks sock_net(skb->sk)->user_ns; an unprivileged user can obtain that capability in a new user and network namespace, where ipset state is per-netns.\nUI:N - The attacker creates the timeout set, sends the IPSET_CMD_ADD messages, and lets its scheduled mtype_gc() work execute; no action by another user is required.\nS:U - The stale htable access in mtype_gc() corrupts kernel heap memory within the same host-kernel security authority; it does not cross a guest-host, IOMMU, or comparable scope boundary.\nC:H - If mtype_resize() frees orig before mtype_gc() pins it, mtype_gc_do() follows reclaimed t->hregion and bucket pointers and processes freed entries; this exploitable htable use-after-free permits kernel-memory disclosure.\nI:H - The stale path increments and decrements freed t->uref, locks and updates freed t->hregion data, clears or frees buckets in mtype_gc_do(), and may call mtype_ahash_destroy() again, yielding kernel-heap write and free primitives suitable for code execution.\nA:H - The use-after-free can dereference or spin-lock freed t->hregion and bucket memory, or free the stale table again through mtype_ahash_destroy(), causing an oops, panic, or hang." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/ipset/ip_set_hash_gen.h" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "67bd3d2350d17c2f4fb158c3f917c10b15ecbc94", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "892399abd1a005a455d5b74d86d82b9773405f2b", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "eee5172741b2c0e73210020732043e5d589295d3", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ecb48c6b9edc78de8dd456c365727ae14b88c1ee", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "0c46c9ce24130657ec7460c27fba5d445f5abd06", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ca9fab1ca15534cef1630e81a479e94b3bbcdb6a", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "5d0c22e73656d050daffad10a2ba8765ce8441c8", "status": "affected", "versionType": "git" }, { "version": "0", "lessThan": "5.10.271", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "5.15.222", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.1.189", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.6.158", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.12.111", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.18.53", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/ipset/ip_set_hash_gen.h" ], "versions": [ { "version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.10.271" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.15.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94" }, { "url": "https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b" }, { "url": "https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3" }, { "url": "https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee" }, { "url": "https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06" }, { "url": "https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a" }, { "url": "https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8" } ], "title": "netfilter: ipset: mark the rcu locked areas properly", "x_generator": { "engine": "bippy-1.2.0" } } } }