{"api_version":"1","generated_at":"2026-10-01T17:25:59+00:00","cve":"CVE-2026-97901","urls":{"html":"https://cve.report/CVE-2026-97901","api":"https://cve.report/api/cve/CVE-2026-97901.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-97901","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-97901"},"summary":{"title":"genetlink: pin family module during policy dump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller's policy dump keeps pointers to the target\nfamily's operation and policy tables in its callback state.  A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller's owner rather than the target family's owner.  The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending.  Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family's module when the dump starts.\nDrop it from the error and done paths.  This matches the lifetime for which\nthe dump context retains the family and policy pointers.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:16","updated_at":"2026-09-25 11:17:16"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f","name":"https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e","name":"https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc","name":"https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97901","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97901","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 508387ad95ef9c13aa6431678c39763e882da2dc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d07dcf9aadd6b2842b439e8668ff7ea2873f28d7 6a1094c34d176827b2b173e163dcc964a13af93f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"97901","cve":"CVE-2026-97901","epss":"0.001980000","percentile":"0.085880000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:24"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netlink/genetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"508387ad95ef9c13aa6431678c39763e882da2dc","status":"affected","version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","versionType":"git"},{"lessThan":"6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e","status":"affected","version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","versionType":"git"},{"lessThan":"6a1094c34d176827b2b173e163dcc964a13af93f","status":"affected","version":"d07dcf9aadd6b2842b439e8668ff7ea2873f28d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netlink/genetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc3","versionStartIncluding":"5.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller's policy dump keeps pointers to the target\nfamily's operation and policy tables in its callback state.  A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller's owner rather than the target family's owner.  The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending.  Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family's module when the dump starts.\nDrop it from the error and done paths.  This matches the lifetime for which\nthe dump context retains the family and policy pointers."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:22:28.655Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc"},{"url":"https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e"},{"url":"https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f"}],"title":"genetlink: pin family module during policy dump","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-97901","datePublished":"2026-09-25T10:22:28.655Z","dateReserved":"2026-09-25T10:18:58.200Z","dateUpdated":"2026-09-25T10:22:28.655Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:16","lastModifiedDate":"2026-09-25 11:17:16","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"97901","Ordinal":"1","Title":"genetlink: pin family module during policy dump","CVE":"CVE-2026-97901","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"97901","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller's policy dump keeps pointers to the target\nfamily's operation and policy tables in its callback state.  A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller's owner rather than the target family's owner.  The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending.  Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family's module when the dump starts.\nDrop it from the error and done paths.  This matches the lifetime for which\nthe dump context retains the family and policy pointers.","Type":"Description","Title":"genetlink: pin family module during policy dump"}]}}}