Vulnerability-Lookup

CVE-2026-98899 (GCVE-0-2026-98899)

Vulnerability from cvelistv5 – Published: 2026-10-23 11:54 – Updated: 2026-10-26 06:56

Title

netfilter: ipset: mark the rcu locked areas properly

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7067 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/67bd3d2350d17c2f4…
https://git.kernel.org/stable/c/892399abd1a005a45…
https://git.kernel.org/stable/c/eee5172741b2c0e73…
https://git.kernel.org/stable/c/ecb48c6b9edc78de8…
https://git.kernel.org/stable/c/0c46c9ce24130657e…
https://git.kernel.org/stable/c/ca9fab1ca15534cef…
https://git.kernel.org/stable/c/5d0c22e73656d050d…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94 (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 892399abd1a005a455d5b74d86d82b9773405f2b (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < eee5172741b2c0e73210020732043e5d589295d3 (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < ecb48c6b9edc78de8dd456c365727ae14b88c1ee (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 0c46c9ce24130657ec7460c27fba5d445f5abd06 (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < ca9fab1ca15534cef1630e81a479e94b3bbcdb6a (git) Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 5d0c22e73656d050daffad10a2ba8765ce8441c8 (git) Affected: 5dd9488ae41070b69d2f4acb580f77db5705f9ca (git) Affected: a469bab3386aebff33c59506f3a95e35b91118fd (git) Affected: 5.4.24 , < 5.5 (semver) Affected: 5.5.8 , < 5.6 (semver)	guessed
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67bd3d2350d17c2f4fb158c3f917c10b15ecbc94",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "892399abd1a005a455d5b74d86d82b9773405f2b",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "eee5172741b2c0e73210020732043e5d589295d3",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "ecb48c6b9edc78de8dd456c365727ae14b88c1ee",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "0c46c9ce24130657ec7460c27fba5d445f5abd06",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "ca9fab1ca15534cef1630e81a479e94b3bbcdb6a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "5d0c22e73656d050daffad10a2ba8765ce8441c8",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5dd9488ae41070b69d2f4acb580f77db5705f9ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a469bab3386aebff33c59506f3a95e35b91118fd",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must send local NETLINK_NETFILTER IPSET_CMD_CREATE/ADD messages: ip_set_create() starts timeout GC, while ip_set_uadd()-\u003eip_set_ad()-\u003ecall_ad()-\u003emtype_add() triggers mtype_resize(). Received packets cannot invoke the userspace-only resize path.\nAC:L - The same attacker chooses IPSET_ATTR_TIMEOUT, INITVAL, BUCKETSIZE, and colliding elements, repeatedly causing scheduled mtype_gc() to race attacker-triggered mtype_resize(); no victim-controlled state or hardware failure is required.\nPR:L - nfnetlink_rcv() requires netlink_net_capable(skb, CAP_NET_ADMIN), but this checks sock_net(skb-\u003esk)-\u003euser_ns; an unprivileged user can obtain that capability in a new user and network namespace, where ipset state is per-netns.\nUI:N - The attacker creates the timeout set, sends the IPSET_CMD_ADD messages, and lets its scheduled mtype_gc() work execute; no action by another user is required.\nS:U - The stale htable access in mtype_gc() corrupts kernel heap memory within the same host-kernel security authority; it does not cross a guest-host, IOMMU, or comparable scope boundary.\nC:H - If mtype_resize() frees orig before mtype_gc() pins it, mtype_gc_do() follows reclaimed t-\u003ehregion and bucket pointers and processes freed entries; this exploitable htable use-after-free permits kernel-memory disclosure.\nI:H - The stale path increments and decrements freed t-\u003euref, locks and updates freed t-\u003ehregion data, clears or frees buckets in mtype_gc_do(), and may call mtype_ahash_destroy() again, yielding kernel-heap write and free primitives suitable for code execution.\nA:H - The use-after-free can dereference or spin-lock freed t-\u003ehregion and bucket memory, or free the stale table again through mtype_ahash_destroy(), causing an oops, panic, or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T06:56:26.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94"
        },
        {
          "url": "https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8"
        }
      ],
      "title": "netfilter: ipset: mark the rcu locked areas properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98899",
    "datePublished": "2026-10-23T11:54:09.249Z",
    "dateReserved": "2026-09-25T10:25:14.379Z",
    "dateUpdated": "2026-10-26T06:56:26.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98899",
      "date": "2026-10-26",
      "epss": "0.00169",
      "percentile": "0.06284"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-24T14:46:34.000Z",
      "cve": "CVE-2026-98899",
      "id": "msrc_CVE-2026-98899",
      "initial_release_date": "2026-10-24T01:04:52.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: ipset: mark the rcu locked areas properly",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98899.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/ipset/ip_set_hash_gen.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "67bd3d2350d17c2f4fb158c3f917c10b15ecbc94",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "892399abd1a005a455d5b74d86d82b9773405f2b",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eee5172741b2c0e73210020732043e5d589295d3",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ecb48c6b9edc78de8dd456c365727ae14b88c1ee",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c46c9ce24130657ec7460c27fba5d445f5abd06",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca9fab1ca15534cef1630e81a479e94b3bbcdb6a",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5d0c22e73656d050daffad10a2ba8765ce8441c8",
                    "status": "affected",
                    "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "5dd9488ae41070b69d2f4acb580f77db5705f9ca",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a469bab3386aebff33c59506f3a95e35b91118fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "affected",
                    "version": "5.5.8",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/ipset/ip_set_hash_gen.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.6"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock."
          }
        ],
        "id": "CVE-2026-98899",
        "lastModified": "2026-10-26T07:17:15.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T12:18:23.897",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}

FKIE_CVE-2026-98899

Vulnerability from fkie_nvd - Published: 2026-10-23 12:18 - Updated: 2026-10-26 07:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67bd3d2350d17c2f4fb158c3f917c10b15ecbc94",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "892399abd1a005a455d5b74d86d82b9773405f2b",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "eee5172741b2c0e73210020732043e5d589295d3",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "ecb48c6b9edc78de8dd456c365727ae14b88c1ee",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "0c46c9ce24130657ec7460c27fba5d445f5abd06",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "ca9fab1ca15534cef1630e81a479e94b3bbcdb6a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "5d0c22e73656d050daffad10a2ba8765ce8441c8",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5dd9488ae41070b69d2f4acb580f77db5705f9ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a469bab3386aebff33c59506f3a95e35b91118fd",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock."
    }
  ],
  "id": "CVE-2026-98899",
  "lastModified": "2026-10-26T07:17:15.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-23T12:18:23.897",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-FFRW-GP84-HX8M

Vulnerability from github – Published: 2026-10-23 12:31 – Updated: 2026-10-24 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98899"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T12:18:23Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.",
  "id": "GHSA-ffrw-gp84-hx8m",
  "modified": "2026-10-24T15:32:47Z",
  "published": "2026-10-23T12:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98899"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-98899

Vulnerability from csaf_microsoft - Published: 2026-10-24 01:04 - Updated: 2026-10-24 14:46

Summary

netfilter: ipset: mark the rcu locked areas properly

Scope

1 vulnerability in this advisory, including CVE-2026-98899.

CVE-2026-98899

Fixed: 1 product Known affected: 1 product Under investigation: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-98899 (GCVE-0-2026-98899)

FKIE_CVE-2026-98899

GHSA-FFRW-GP84-HX8M

MSRC_CVE-2026-98899

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour