Improper locking in Linux kernel - CVE-2026-98899

Vulnerability identifier: #VU157617

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98899

CWE-ID: CWE-667

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
• https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8
• https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
• https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
• https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
• https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
• https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3

• Improper locking in Linux kernel netfilter ipset
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more