CVE-2026-98571 net: stmmac: clear stale buf->page after recycling on skb build failure
A use-after-free vulnerability in the Linux kernel stmmac driver allows attackers to cause denial of service or potentially execute code via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98571?
CVE-2026-98571 is an use after free vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: clear stale buf->page after recycling on skb build failure
In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away.
With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs the already-recycled page back into the RX descriptor.
Clear buf->page on the napi_build_skb() failure path to keep the buffer lifecycle consistent with the other consumption sites.
Which versions are affected by CVE-2026-98571?
How do I fix CVE-2026-98571?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98571 being exploited?
There is no known exploitation of CVE-2026-98571 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98571, DEBIAN-CVE-2026-98571, GHSA-j482-jx6v-w2pf, UBUNTU-CVE-2026-98571.