SB2026102431 - Improper locking in Linux kernel netfilter ipset
Published: October 24, 2026
Security Bulletin ID
SB2026102431
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper locking (CVE-ID: CVE-2026-98899)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service.
The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
- https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8
- https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
- https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
- https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
- https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
- https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3