Cloudanix VulnDB

CVE-2026-98558

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can leave network memory buffers stranded when processors are taken offline, potentially freezing parts of the networking system during routine hardware management.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel networking leaves skb_defer_nodes undrained on CPU offline, stranding skbs with page_pool fragments and blocking page_pool_destroy() indefinitely; also mishandles IPI failures and NUMA node drains during teardown.

Why it matters to the business

Systems performing CPU hot-unplug or running in environments with dynamic core management may experience network stack stalls or hangs when tearing down interfaces or drivers, disrupting availability in cloud, container, or high-density server deployments.

How an attack unfolds

An attacker with local access or control over workload scheduling triggers repeated CPU offline events while network buffers are pending below defer thresholds; if page_pool-backed skbs are involved, device or driver unload on the affected NUMA node blocks indefinitely.

How to fix it

Apply the upstream kernel commit that adds skb_defer_nodes flushing inside dev_cpu_dead(), resets defer_ipi_scheduled on IPI failure, drains the final NUMA node slot, and re-checks cpu_online() after llist_add() in skb_attempt_defer_free(). Reboot after installing the fixed kernel.

How to confirm the fix worked

Confirm the presence of the dev_cpu_dead() flush logic and the cpu_online() re-check in skb_attempt_defer_free(); test by repeatedly offlining CPUs while exercising network workloads and verifying that page_pool_destroy completes without hanging.

Typical attack path

  1. Gain local execution or scheduling control on target system
  2. Induce or wait for CPU offline events while holding network skbs
  3. Trigger netdev or driver teardown on the offline CPU or NUMA node
  4. Observe indefinite stall in page_pool_destroy or related cleanup

How to detect it

Review kernel logs for hung tasks or warnings mentioning skb_defer_nodes, dev_cpu_dead, page_pool_destroy stalls, or IPI failures during CPU offline; inspect dmesg and trace events around hotplug events for signs of blocked cleanup.

What your security team should do

  • Prioritize patching kernel packages on systems that perform CPU hotplug or run latency-sensitive network workloads
  • Monitor for stalled network cleanup tasks during maintenance windows that offline cores
  • Limit unprivileged access to CPU affinity or hotplug interfaces until fixed kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline, dev_cpu_dead() drains its softnet queues (completion_queue, output_queue, poll_list, process_queue, and input_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched. If oldcpu goes offline while holding pending skbs in its skb_defer_nodes lists (e.g. below the sysctl_skb_defer_max >> 1 IPI threshold, or if the IPI races with CPU teardown), those skbs remain stranded until oldcpu is brought back online. If any of these skbs hold page_pool fragments, page_pool_destroy() will stall indefinitely waiting for inflight pages to be returned when a netdev or driver is torn down while oldcpu is offline. Additionally, if smp_call_function_single_async() fails in kick_defer_list_purge() because the target CPU went offline, reset defer_ipi_scheduled to 0 so future IPI kicks are not blocked when the CPU comes back online. Also, if oldcpu was the last online CPU on its NUMA node, drain that node's slot across all CPUs so no skbs deferred from that node remain stranded on idle remote CPUs (or if the node itself is subsequently offlined). Finally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and whether the caller migrated CPUs after llist_add(), flushing the node list if so, to close the preemption TOCTOU race against CPU/node teardown.

Affected packages

Ecosystem Package Introduced Fixed