{"api_version":"1","generated_at":"2026-10-26T06:23:23+00:00","cve":"CVE-2026-98899","urls":{"html":"https://cve.report/CVE-2026-98899","api":"https://cve.report/api/cve/CVE-2026-98899.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98899","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98899"},"summary":{"title":"netfilter: ipset: mark the rcu locked areas properly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 12:18:23","updated_at":"2026-10-24 14:16:48"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3","name":"https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94","name":"https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8","name":"https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06","name":"https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b","name":"https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee","name":"https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a","name":"https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98899","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98899","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 892399abd1a005a455d5b74d86d82b9773405f2b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 eee5172741b2c0e73210020732043e5d589295d3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ecb48c6b9edc78de8dd456c365727ae14b88c1ee git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 0c46c9ce24130657ec7460c27fba5d445f5abd06 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ca9fab1ca15534cef1630e81a479e94b3bbcdb6a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 5d0c22e73656d050daffad10a2ba8765ce8441c8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.271 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.222 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.189 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.158 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.111 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.53 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/ipset/ip_set_hash_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"67bd3d2350d17c2f4fb158c3f917c10b15ecbc94","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"892399abd1a005a455d5b74d86d82b9773405f2b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"eee5172741b2c0e73210020732043e5d589295d3","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ecb48c6b9edc78de8dd456c365727ae14b88c1ee","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"0c46c9ce24130657ec7460c27fba5d445f5abd06","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ca9fab1ca15534cef1630e81a479e94b3bbcdb6a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5d0c22e73656d050daffad10a2ba8765ce8441c8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5.10.271","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.15.222","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.1.189","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.6.158","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.12.111","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.53","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/ipset/ip_set_hash_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The attacker must send local NETLINK_NETFILTER IPSET_CMD_CREATE/ADD messages: ip_set_create() starts timeout GC, while ip_set_uadd()->ip_set_ad()->call_ad()->mtype_add() triggers mtype_resize(). Received packets cannot invoke the userspace-only resize path.\nAC:L - The same attacker chooses IPSET_ATTR_TIMEOUT, INITVAL, BUCKETSIZE, and colliding elements, repeatedly causing scheduled mtype_gc() to race attacker-triggered mtype_resize(); no victim-controlled state or hardware failure is required.\nPR:L - nfnetlink_rcv() requires netlink_net_capable(skb, CAP_NET_ADMIN), but this checks sock_net(skb->sk)->user_ns; an unprivileged user can obtain that capability in a new user and network namespace, where ipset state is per-netns.\nUI:N - The attacker creates the timeout set, sends the IPSET_CMD_ADD messages, and lets its scheduled mtype_gc() work execute; no action by another user is required.\nS:U - The stale htable access in mtype_gc() corrupts kernel heap memory within the same host-kernel security authority; it does not cross a guest-host, IOMMU, or comparable scope boundary.\nC:H - If mtype_resize() frees orig before mtype_gc() pins it, mtype_gc_do() follows reclaimed t->hregion and bucket pointers and processes freed entries; this exploitable htable use-after-free permits kernel-memory disclosure.\nI:H - The stale path increments and decrements freed t->uref, locks and updates freed t->hregion data, clears or frees buckets in mtype_gc_do(), and may call mtype_ahash_destroy() again, yielding kernel-heap write and free primitives suitable for code execution.\nA:H - The use-after-free can dereference or spin-lock freed t->hregion and bucket memory, or free the stale table again through mtype_ahash_destroy(), causing an oops, panic, or hang."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:09:30.135Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94"},{"url":"https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b"},{"url":"https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3"},{"url":"https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee"},{"url":"https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06"},{"url":"https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a"},{"url":"https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8"}],"title":"netfilter: ipset: mark the rcu locked areas properly","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98899","datePublished":"2026-10-23T11:54:09.249Z","dateReserved":"2026-09-25T10:25:14.379Z","dateUpdated":"2026-10-24T14:09:30.135Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 12:18:23","lastModifiedDate":"2026-10-24 14:16:48","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98899","Ordinal":"1","Title":"netfilter: ipset: mark the rcu locked areas properly","CVE":"CVE-2026-98899","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98899","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.","Type":"Description","Title":"netfilter: ipset: mark the rcu locked areas properly"}]}}}