CVE-2026-97901

genetlink: pin family module during policy dump

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

genetlink: pin family module during policy dump

The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and remain pending after the initial request.

Netlink pins the module which owns the dump callback, but in this case that is the controller's owner rather than the target family's owner. The target family can consequently be unregistered and its module unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module.

Take a reference to the target family's module when the dump starts. Drop it from the error and done paths. This matches the lifetime for which the dump context retains the family and policy pointers.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 7ee2c0f82354da9bae04b14e0e5b2037d2de48a7Affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 7f71414c206a0e2babf4ec2756c0d15776c5dfd2Affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before ad01ec35360e803670168d63a856629d6aeaec48Affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 1a345d95e59a99e25404138b5a1ec2edcb03269fAffected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6e4d746e55c83c240cffce92356763d16b236af5Affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 508387ad95ef9c13aa6431678c39763e882da2dcAffected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6d8e653fcf1c90310797eeba8e5fafe9ccc3de9eAffected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6a1094c34d176827b2b173e163dcc964a13af93fAffected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 7ee2c0f82354da9bae04b14e0e5b2037d2de48a7Affected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 7f71414c206a0e2babf4ec2756c0d15776c5dfd2Affected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before ad01ec35360e803670168d63a856629d6aeaec48Affected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 1a345d95e59a99e25404138b5a1ec2edcb03269fAffected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6e4d746e55c83c240cffce92356763d16b236af5Affected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 508387ad95ef9c13aa6431678c39763e882da2dcAffected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6d8e653fcf1c90310797eeba8e5fafe9ccc3de9eAffected
d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 to before 6a1094c34d176827b2b173e163dcc964a13af93fAffected

LinuxLinux

5.8Affected
before 5.8Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.