In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With… (CVE-2026-98804)

The Linux kernel contained a use-after-free vulnerability in the page_pool subsystem's page_pool_recycle_ring_bulk() function. When CONFIG_PAGE_POOL_STATS=y, the function updated recycle statistics after releasing the producer lock. If the last inflight netmems of a pool were recycled while the pool was being destroyed, page_pool_release() could free the pool before recycle_stat_add() executed, causing a use-after-free. Previous commits moved the stat update after unlocking, and a later commit added a barrier only for page_pool_recycle_in_ring(), not page_pool_recycle_ring_bulk(). The vulnerability was fixed by moving the stats update back under the lock to ensure proper synchronization.

This vulnerability could lead to use-after-free conditions in the kernel's networking memory management, potentially causing system instability or crashes. No information about exploitation in the wild is available. The impact is limited to systems with CONFIG_PAGE_POOL_STATS enabled and affected kernel versions.

A fix has been applied in the Linux kernel source code to move the stats update under the lock, preventing the use-after-free condition. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level issue, applying the official kernel update or patch from the Linux vendor is the recommended remediation.