Answer in brief
CVE-2026-98804 records a Unknown severity vulnerability in net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=fcc680a647ba77370480fe753664cc10d572b240 <f78d45d5f1ac4141a03f033141368671da4293e4 || >=fcc680a647ba77370480fe753664cc10d572b240 <0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c || >=fcc680a647ba77370480fe753664cc10d572b240 <bdea4980182e3badac74f04df6c07492b91c569e | f78d45d5f1ac4141a03f033141368671da4293e4, 0b105f4eb78e5ee39e5a74c47c9efd69b6ac849c, bdea4980182e3badac74f04df6c07492b91c569e |
| Linux/Linuxgeneric | 6.14 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.
Quoted source text, attributed separately from HOL analysis.