CVE-2026-98804: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
In the Linux kernel, the following vulnerability has been resolved:
net: pagepool: fix use-after-free in pagepoolrecycleringbulk()
With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, pagepoolrelease() can pass its producer-lock barrier and free the pool before recyclestatadd() runs.
Commit fcc680a647ba7 ("pagepool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("pagepool: Fix use-after-free in pagepoolrecycleinring") later added the barrier, but only fixed pagepoolrecycleinring(). Move the update back under the lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Move the recycle statistics update in page_pool_recycle_ring_bulk() back under the producer lock so recycle_stat_add() runs before the lock is released.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel builds with CONFIG_PAGE_POOL_STATS enabled. It is triggered in the page_pool_recycle_ring_bulk() path when the final in-flight netmems of a page pool are recycled while that pool is being destroyed.
What race causes the use-after-free?
The bulk recycle path updates recycle statistics after releasing the producer lock. A concurrent page_pool_release() can pass its producer-lock barrier and free the page pool before the deferred recycle_stat_add() operation accesses it.
What is the relevant mitigation if an update cannot be applied immediately?
The provided information identifies CONFIG_PAGE_POOL_STATS as a condition for the vulnerable path. Disabling that kernel configuration removes the statistics update involved in this race, where operationally feasible.