{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98818 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98818 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98818 and fix it if it is affected.\n\nWhat it is: CVE-2026-98818 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98818 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98818/ (Markdown: https://insights.sbomify.com/CVE-2026-98818/index.md)","id":"CVE-2026-98818","markdown":"https://insights.sbomify.com/CVE-2026-98818/index.md","name":"CVE-2026-98818","record":{"aliases":["BELL-CVE-2026-98818","DEBIAN-CVE-2026-98818","GHSA-hqwf-4r5g-q2h4","UBUNTU-CVE-2026-98818"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A deadlock in the Linux kernel memory allocator can cause a system hang when kfree_rcu is called under specific scheduler locks.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\n\nSince kfree_rcu() can be called under pi_lock (a raw spinlock in the\nscheduler), kfree_rcu() itself should never allocate memory with\n__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring pi_lock,\nwhich leads to a deadlock.\n\nReproducing the issue even intentionally was not straightforward.\nThe set_cpus_allowed_force() path that is called under pi_lock is\nexercised very rarely, and competing tasks that allocate memory will\nmost likely wake kswapd up.\n\nTherefore the existence of the deadlock was verified with a modified\nkernel that has a lockdep map for waking up kswapd:\n\n  ======================================================\n  WARNING: possible circular locking dependency detected\n  7.2.0-rc1-slab-for-next+ #10 Not tainted\n  ------------------------------------------------------\n  git/6660 is trying to acquire lock:\n  ffff8e524533c550 (\u0026p-\u003epi_lock){-.-.}-{2:2}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n  but task is already holding lock:\n  ffff8e57bffff1a0 (\u0026pgdat-\u003ekswapd_wait){....}-{3:3}, at: _raw_spin_lock_irqsave+0x12/0x20\n\n  which lock already depends on the new lock.\n\n  the existing dependency chain (in reverse order) is:\n\n  -\u003e #2 (\u0026pgdat-\u003ekswapd_wait){....}-{3:3}:\n         __lock_acquire+0x5a4/0xc50\n         lock_acquire.part.0+0xb7/0x240\n         lock_acquire+0x70/0x170\n         __raw_spin_lock_irqsave+0x44/0x80\n         _raw_spin_lock_irqsave+0x12/0x20\n         __wake_up_common_lock+0x31/0xa0\n         __wake_up+0x20/0x40\n         kswapd_wakeup_wake+0x7e/0x110\n         wakeup_kswapd+0x295/0x320\n         wake_all_kswapds+0xac/0x1a0\n         __alloc_pages_slowpath.constprop.0+0x282/0xf80\n         __alloc_frozen_pages_noprof+0x32a/0x360\n         alloc_slab_page+0x2e/0x160\n         allocate_slab+0x82/0x420\n         new_slab+0x52/0xb0\n         refill_objects+0x13d/0x190\n         refill_sheaf+0x5d/0xd0\n         __pcs_replace_empty_main+0x230/0xb10\n         [...]\n\n  -\u003e #1 (kswapd_wakeup){-.-.}-{0:0}:\n         __lock_acquire+0x5a4/0xc50\n         lock_sync.part.0+0x75/0x100\n         lock_sync+0x36/0x70\n         might_wakeup_kswapd+0x61/0xa0\n         __kfree_rcu_sheaf+0x33/0xd90\n         kvfree_call_rcu+0x1d4/0x3b0\n         set_cpus_allowed_force+0x163/0x220\n         cpuset_cpus_allowed_fallback+0x18b/0x240\n         select_fallback_rq+0x1e6/0x250\n\t [...]\n\n  -\u003e #0 (\u0026p-\u003epi_lock){-.-.}-{2:2}:\n         check_prev_add+0xe6/0xe00\n         validate_chain+0x51e/0x6e0\n         __lock_acquire+0x5a4/0xc50\n         lock_acquire.part.0+0xb7/0x240\n         lock_acquire+0x70/0x170\n         __raw_spin_lock_irqsave+0x44/0x80\n         _raw_spin_lock_irqsave+0x12/0x20\n         try_to_wake_up+0x77/0xa90\n         default_wake_function+0x27/0x60\n         autoremove_wake_function+0x23/0xb0\n         __wake_up_common+0xb8/0x170\n         __wake_up_common_lock+0x51/0xa0\n         __wake_up+0x20/0x40\n         kswapd_wakeup_wake+0x7e/0x110\n         wakeup_kswapd+0x295/0x320\n         wake_all_kswapds+0xac/0x1a0\n         __alloc_pages_slowpath.constprop.0+0x282/0xf80\n         __alloc_frozen_pages_noprof+0x32a/0x360\n         alloc_slab_page+0x2e/0x160\n         allocate_slab+0x82/0x420\n         new_slab+0x52/0xb0\n         refill_objects+0x13d/0x190\n         refill_sheaf+0x5d/0xd0\n         __pcs_replace_empty_main+0x230/0xb10\n         [...]\n\n  other info that might help us debug this:\n\n  Chain exists of:\n    \u0026p-\u003epi_lock --\u003e kswapd_wakeup --\u003e \u0026pgdat-\u003ekswapd_wait\n\n   Possible unsafe locking scenario:\n\n         CPU0                    CPU1\n         ----                    ----\n    lock(\u0026pgdat-\u003ekswapd_wait);\n                                 lock(kswapd_wakeup);\n                                 lock(\u0026pgdat-\u003ekswapd_wait);\n    lock(\u0026p-\u003epi_lock);\n\n   *** DEADLOCK ***\n\n  3 locks held by git/6660:\n   #0: ffff8e519f0e9e20 (\u0026type-\u003ei_mutex_dir_key#6){++++}-{4:4}, at: lookup_slow+0x2d/0x60\n   #1: ffffffff8a31c460 (kswapd_wakeup){-.-.}-\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","id":"CVE-2026-98818","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Bluetooth: btintel: validate DDC record lengths","id":"CVE-2026-98819"},"packages":[],"prev":{"headline":"ASoC: SDCA: Add better pm_runtime error handling in func probe","id":"CVE-2026-98817"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A deadlock in the Linux kernel memory allocator can cause a system hang when kfree_rcu is called under specific scheduler locks.","url":"https://insights.sbomify.com/CVE-2026-98818/"}