CVE-2026-98899

netfilter: ipset: mark the rcu locked areas properly

State: Published
Severity: 7.8 High
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94Affected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 892399abd1a005a455d5b74d86d82b9773405f2bAffected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before eee5172741b2c0e73210020732043e5d589295d3Affected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before ecb48c6b9edc78de8dd456c365727ae14b88c1eeAffected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 0c46c9ce24130657ec7460c27fba5d445f5abd06Affected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before ca9fab1ca15534cef1630e81a479e94b3bbcdb6aAffected f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 5d0c22e73656d050daffad10a2ba8765ce8441c8Affected 5dd9488ae41070b69d2f4acb580f77db5705f9caAffected a469bab3386aebff33c59506f3a95e35b91118fdAffected 5.4.24 to before 5.5Affected 5.5.8 to before 5.6Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94Affected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 892399abd1a005a455d5b74d86d82b9773405f2bAffected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before eee5172741b2c0e73210020732043e5d589295d3Affected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before ecb48c6b9edc78de8dd456c365727ae14b88c1eeAffected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 0c46c9ce24130657ec7460c27fba5d445f5abd06Affected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before ca9fab1ca15534cef1630e81a479e94b3bbcdb6aAffected
f66ee0410b1c3481ee75e5db9b34547b4d582465 to before 5d0c22e73656d050daffad10a2ba8765ce8441c8Affected
5dd9488ae41070b69d2f4acb580f77db5705f9caAffected
a469bab3386aebff33c59506f3a95e35b91118fdAffected
5.4.24 to before 5.5Affected
5.5.8 to before 5.6Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.