---
id: CVE-2026-98804
title: 'net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

  With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates
  the recycle stats after droppi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fcc680a647ba77370480fe753664cc10d572b240 <
    f78d45d5f1ac4141a03f033141368671da4293e4
  - >-
    Linux >= fcc680a647ba77370480fe753664cc10d572b240 <
    0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c
  - >-
    Linux >= fcc680a647ba77370480fe753664cc10d572b240 <
    bdea4980182e3badac74f04df6c07492b91c569e
  - Linux 6.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:48:51.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98804'
references:
  - url: 'https://git.kernel.org/stable/c/f78d45d5f1ac4141a03f033141368671da4293e4'
  - url: 'https://git.kernel.org/stable/c/0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c'
  - url: 'https://git.kernel.org/stable/c/bdea4980182e3badac74f04df6c07492b91c569e'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.481Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates
the recycle stats after dropping the producer lock. If it just recycled
the last inflight netmems of a pool being destroyed, page_pool_release()
can pass its producer-lock barrier and free the pool before
recycle_stat_add() runs.

Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk")
moved this stat update after the unlock. Commit 271683bb2cf32
("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later
added the barrier, but only fixed page_pool_recycle_in_ring(). Move
the update back under the lock.

## Affected

- `Linux >= fcc680a647ba77370480fe753664cc10d572b240 < f78d45d5f1ac4141a03f033141368671da4293e4`
- `Linux >= fcc680a647ba77370480fe753664cc10d572b240 < 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c`
- `Linux >= fcc680a647ba77370480fe753664cc10d572b240 < bdea4980182e3badac74f04df6c07492b91c569e`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.