UBUNTU-CVE-2026-98804: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk() With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, pagepoolrelease() can pass its producer-lock barrier and free the pool before recyclestatadd() runs. Commit fcc680a647ba7 ("pagepool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("pagepool: Fix use-after-free in pagepoolrecycleinring") later added the barrier, but only fixed pagepoolrecycleinring(). Move the update back under the lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Linux kernel page_pool_recycle_ring_bulk(), move the recycle-stat update back under the producer lock so recycle_stat_add() runs before the lock is released.