High 7.8Published Oct 23, 2026

CVE-2026-98899netfilter: ipset: mark the rcu locked areas properly

Updated under an hour ago (Oct 27, 2026, 7:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 11% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.21% (percentile 11)
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f66ee0410b1c3481ee75e5db9b34547b4d582465 before 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before 892399abd1a005a455d5b74d86d82b9773405f2b; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before eee5172741b2c0e73210020732043e5d589295d3; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before ecb48c6b9edc78de8dd456c365727ae14b88c1ee; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before 0c46c9ce24130657ec7460c27fba5d445f5abd06; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before ca9fab1ca15534cef1630e81a479e94b3bbcdb6a; from f66ee0410b1c3481ee75e5db9b34547b4d582465 before 5d0c22e73656d050daffad10a2ba8765ce8441c8; 5dd9488ae41070b69d2f4acb580f77db5705f9ca; and 3 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3
https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.