{"id":41276,"date":"2026-10-19T00:32:58","date_gmt":"2026-10-18T16:32:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98804"},"modified":"2026-10-19T00:32:58","modified_gmt":"2026-10-18T16:32:58","slug":"cve-2026-98804","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98804","title":{"rendered":"CVE-2026-98804 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: page_pool: fix u"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()<\/p>\n<p>With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates<br \/>\nthe recycle stats after dropping the producer lock. If it just recycled<br \/>\nthe last inflight netmems of a pool being destroyed, page_pool_release()<br \/>\ncan pass its producer-lock barrier and free the pool before<br \/>\nrecycle_stat_add() runs.<\/p>\n<p>Commit fcc680a647ba7 (&#8220;page_pool: allow mixing PPs within one bulk&#8221;)<br \/>\nmoved this stat update after the unlock. Commit 271683bb2cf32<br \/>\n(&#8220;page_pool: Fix use-after-free in page_pool_recycle_in_ring&#8221;) later<br \/>\nadded the barrier, but only fixed page_pool_recycle_in_ring(). Move<br \/>\nthe update back under the lock.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()<\/p>\n<p>With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() u<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41276","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}