CVE-2026-98804 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
A use-after-free in the Linux kernel page pool allows attackers to cause denial of service or execute code when page pool stats are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98804?
CVE-2026-98804 is an use after free vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs.
Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
Which versions are affected by CVE-2026-98804?
How do I fix CVE-2026-98804?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98804 being exploited?
There is no known exploitation of CVE-2026-98804 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98804, DEBIAN-CVE-2026-98804, GHSA-4g8w-5g3m-vf26, UBUNTU-CVE-2026-98804.