CVE-2026-98804None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after droppi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs.
Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
Linux >= fcc680a647ba77370480fe753664cc10d572b240 < f78d45d5f1ac4141a03f033141368671da4293e4Linux >= fcc680a647ba77370480fe753664cc10d572b240 < 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849cLinux >= fcc680a647ba77370480fe753664cc10d572b240 < bdea4980182e3badac74f04df6c07492b91c569eLinux 6.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98768Noneusb: typec: anx7411 - stop the IRQ before destroying the workqueue
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers