CVE-2026-98899

netfilter: ipset: mark the rcu locked areas properly

Published Oct 23, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep
the rcu lock because the referred hash table can't
disappear. Also, from the same reason in mtype_gc we
need the rcu lock and not a spinlock.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< 892399abd1a005a455d5b74d86d82b9773405f2b
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< eee5172741b2c0e73210020732043e5d589295d3
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< ecb48c6b9edc78de8dd456c365727ae14b88c1ee
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< 0c46c9ce24130657ec7460c27fba5d445f5abd06
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
`f66ee0410b1c3481ee75e5db9b34547b4d582465`	affected	< 5d0c22e73656d050daffad10a2ba8765ce8441c8
`5dd9488ae41070b69d2f4acb580f77db5705f9ca`	affected	—
`a469bab3386aebff33c59506f3a95e35b91118fd`	affected	—
`5.4.24`	affected	< 5.5
`5.5.8`	affected	< 5.6

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,67bd3d2350d17c2f4fb158c3f917c10b15ecbc94)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,892399abd1a005a455d5b74d86d82b9773405f2b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,eee5172741b2c0e73210020732043e5d589295d3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ecb48c6b9edc78de8dd456c365727ae14b88c1ee)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0c46c9ce24130657ec7460c27fba5d445f5abd06)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ca9fab1ca15534cef1630e81a479e94b3bbcdb6a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5d0c22e73656d050daffad10a2ba8765ce8441c8)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Version	Status	Scheme	Platform
`[5.10.0,6.0.0)`	unaffected	semver	—
`[5.15.0,6.0.0)`	unaffected	semver	—
`[6.1.0,7.0.0)`	unaffected	semver	—
`[6.6.0,7.0.0)`	unaffected	semver	—
`[6.12.0,7.0.0)`	unaffected	semver	—
`[6.18.0,7.0.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,67bd3d2350d17c2f4fb158c3f917c10b15ecbc94)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,892399abd1a005a455d5b74d86d82b9773405f2b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,eee5172741b2c0e73210020732043e5d589295d3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ecb48c6b9edc78de8dd456c365727ae14b88c1ee)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0c46c9ce24130657ec7460c27fba5d445f5abd06)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ca9fab1ca15534cef1630e81a479e94b3bbcdb6a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5d0c22e73656d050daffad10a2ba8765ce8441c8)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.0,6.0.0)`	unaffected	semver	—
`[5.15.0,6.0.0)`	unaffected	semver	—
`[6.1.0,7.0.0)`	unaffected	semver	—
`[6.6.0,7.0.0)`	unaffected	semver	—
`[6.12.0,7.0.0)`	unaffected	semver	—
`[6.18.0,7.0.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.169% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8
https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3

History

Oct 25, 2026 1:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Oct 24, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Oct 24, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Oct 23, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 6:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Oct 23, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
Title		netfilter: ipset: mark the rcu locked areas properly
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06 https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8 https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94 https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3