Memory leak in Linux kernel - CVE-2026-98368
Published: October 6, 2026
Vulnerability identifier: #VU153543
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98368
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leak kernel page memory.
The vulnerability exists due to missing release of a destination-page reference in esp_output_tail() and skb_release_data() when processing out-of-place ESP output containing zerocopy managed fragments. A local user can trigger this processing to leak kernel page memory.
The destination page retains a reference while SKBFL_MANAGED_FRAG_REFS remains set, causing skb_release_data() to take its skip_unref branch. The leak occurs at packet rate.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98368
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6
- https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3
- https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134
- https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d
- https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844
- https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2