Use-after-free in Linux kernel - CVE-2026-98239
Published: October 7, 2026
Vulnerability identifier: #VU153784
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98239
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write to freed kernel memory.
The vulnerability exists due to use-after-free in lan743x_rx_process_buffer() when processing checksum-success packets that span multiple receive buffers. A remote attacker can send a packet that spans multiple receive buffers to write to freed kernel memory.
Receive checksum offload must be enabled. Multi-buffer reception can occur after a live MTU increase because existing receive ring entries retain their old buffer size until replenished.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98239
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0e52886c4324c9897c2c62f92be3dc8316cee67e
- https://git.kernel.org/stable/c/161a403c8625e152de03d1da22bbf9cda6dc9f9f
- https://git.kernel.org/stable/c/5c216bfa9fb7b36804485e67975e9c98055b31ef
- https://git.kernel.org/stable/c/6fe5c3a2503983abb431d93faeadfc7f5e6a7e33
- https://git.kernel.org/stable/c/a58024835c704419bb46d2a34e5223f65605f958
- https://git.kernel.org/stable/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5