Cloudanix VulnDB

CVE-2026-98284

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's networking code could let an attacker cause crashes or read private memory by racing diagnostic tools against socket configuration changes.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in netlink group bitmap: netlink_realloc_groups() performs krealloc under table lock and immediately frees the old bitmap when size crosses kmalloc bucket boundary, while lockless RCU readers (sk_diag_dump_groups via rhashtable walk and netlink_native_seq_show) can dereference the freed pointer or read past its end when paired with updated ngroups value.

Why it matters to the business

Kernel memory corruption or information disclosure risk in networking stack can lead to system instability, crashes, or data leaks on servers and devices using netlink sockets for diagnostics or multicast group management; low exploitability reduces immediate urgency but still requires kernel updates.

How an attack unfolds

Attacker binds or reconfigures a netlink socket to trigger group bitmap reallocation crossing kmalloc bucket sizes; concurrently forces diagnostic dump via sk_diag_dump_groups or /proc/net/netlink walk so a reader loads the freed old bitmap pointer together with new ngroups size, causing out-of-bounds read or use-after-free.

How to fix it

Apply kernel patch that allocates replacement bitmap, publishes groups before ngroups with release semantics, and defers old bitmap free via kfree_rcu_mightsleep after releasing table lock; rebuild and reboot to updated kernel.

How to confirm the fix worked

Confirm kernel source contains the RCU-grace-period free and release-store ordering for groups/ngroups; run reproducer that exercises bind/setsockopt concurrently with diag dumps and /proc/net/netlink reads without triggering KASAN or slab warnings.

Typical attack path

  1. Trigger netlink socket bind or setsockopt that invokes netlink_realloc_groups under table lock
  2. Force concurrent lockless reader via diagnostic socket dump or /proc/net/netlink open
  3. Reader loads stale groups pointer after free but before RCU grace period or loads new ngroups with old smaller buffer
  4. Resulting dereference or oversized copy triggers UAF or OOB read in kernel context

How to detect it

Inspect kernel logs for slab-use-after-free or out-of-bounds warnings involving netlink groups; correlate timestamps of netlink bind/setsockopt syscalls with concurrent diag socket activity or /proc/net/netlink reads; review crash dumps for sk_diag_dump_groups or netlink_native_seq_show stack frames.

What your security team should do

  • Prioritize kernel upgrade on systems exposing netlink diagnostics or heavy multicast usage
  • Monitor for netlink-related crashes or slab corruption in production kernels
  • Apply defense-in-depth by restricting unprivileged netlink access via LSM or namespaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk->groups while lockless readers can use it netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately. Two readers of nlk->groups / nlk->ngroups do not hold the netlink table lock: 1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the rhashtable walk in __netlink_diag_dump(), which only holds RCU. Only the mc_list part of the dump takes nl_table_lock. 2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been lockless since commit 21e4902aea80 ("netlink: Lockless lookup with RCU grace period in socket release"). Both can read a freed buffer, and sk_diag_dump_groups() can also read past the end of the old (smaller) buffer if it happens to load the old @groups pointer together with the new @ngroups value, copying the result into a NETLINK_DIAG_GROUPS attribute. This is the same class of bug that commit f773608026ee ("netlink: access nlk groups safely in netlink bind and getname") fixed for bind() and getname(); these two readers were missed. Simply grabbing the table lock in sk_diag_dump_groups() is not an option, because it is also called with nl_table_lock already held from the mc_list section of the dump. Make the lockless readers safe instead: - Allocate a new bitmap and free the old one after an RCU grace period, instead of relying on the implicit kfree() done by krealloc(). - Publish @groups before @ngroups, both with release semantics, and have the lockless readers load @ngroups first. A reader can then never pair the new (bigger) size with the old (smaller) buffer, and a reader picking up the new pointer while still seeing the old size is guaranteed to see the initialized bitmap. netlink_realloc_groups() is called from process context (bind() and setsockopt()), so kfree_rcu_mightsleep() can be used, once the table has been released.

Affected packages

Ecosystem Package Introduced Fixed