CVE-2026-98804
Description
In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
How to fix
- Linux Linuxf78d45d5f1ac4141a03f033141368671da4293e4, 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c, bdea4980182e3badac74f04df6c07492b91c569e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | fcc680a647ba77370480fe753664cc10d572b240 ≤ v < f78d45d5f1ac4141a03f033141368671da4293e4, fcc680a647ba77370480fe753664cc10d572b240 ≤ v < 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c, fcc680a647ba77370480fe753664cc10d572b240 ≤ v < bdea4980182e3badac74f04df6c07492b91c569e, 6.14 | f78d45d5f1ac4141a03f033141368671da4293e4, 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c, bdea4980182e3badac74f04df6c07492b91c569e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.