Riskcovery

CVE-2026-98804

net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs.

Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fcc680a647ba77370480fe753664cc10d572b240 to before f78d45d5f1ac4141a03f033141368671da4293e4Affected
  • fcc680a647ba77370480fe753664cc10d572b240 to before 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849cAffected
  • fcc680a647ba77370480fe753664cc10d572b240 to before bdea4980182e3badac74f04df6c07492b91c569eAffected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.