Use-after-free in Linux kernel - CVE-2026-98368
Published: October 6, 2026
Vulnerability identifier: #VU153542
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98368
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a use-after-free of zerocopy pages.
The vulnerability exists due to incorrect page reference counting in the ESP output path and esp_ssg_unref() when processing out-of-place output containing zerocopy managed fragments. A local user can trigger this processing to cause a use-after-free of zerocopy pages.
The affected pages remain pinned while their reference counts fall below the GUP pin bias.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98368
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6
- https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3
- https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134
- https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d
- https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844
- https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2