CVE-2026-98899
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A recently discovered flaw in Linux could let someone already on the computer cause crashes or gain more control by racing certain internal operations.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition due to improper RCU locking when bumping uref counters and during mtype_gc in ipset hash table handling, enabling potential use-after-free or memory corruption in the kernel netfilter subsystem.
Why it matters to the business
Local attackers on Linux systems could trigger kernel crashes or privilege escalation, impacting stability and security of servers, firewalls, and network appliances that rely on ipset for rule management; the issue is only two days old with no known exploitation yet.
How an attack unfolds
A local attacker with low privileges triggers concurrent ipset operations that race on reference counting and garbage collection paths lacking proper RCU protection, leading to memory corruption that can be leveraged for code execution or denial of service.
How to fix it
Update the Linux kernel to a version containing the fix that properly marks RCU locked areas when handling uref counters and requires RCU rather than spinlock in mtype_gc for ipset.
How to confirm the fix worked
Confirm the patched kernel source includes RCU read lock acquisition around uref bumps and mtype_gc; test ipset functionality under concurrent load after upgrade and verify no related warnings in dmesg.
Typical attack path
- Gain local user access on a Linux system
- Perform or trigger concurrent ipset add/delete/lookup operations
- Exploit the missing RCU lock around uref increments and mtype_gc
- Achieve memory corruption for privilege escalation or system crash
How to detect it
Review kernel logs (dmesg, syslog) for oops, warnings, or RCU-related stalls involving ipset or netfilter; correlate with audit logs showing unusual ipset command sequences from non-root users.
What your security team should do
- Prioritize kernel updates on all exposed Linux systems within the next patch cycle
- Limit untrusted local accounts and ipset administrative access
- Monitor kernel mailing lists and distributions for the backported fix
- Audit ipset usage in production workloads for exposure
The record
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|