CVE-2026-98804
Microsoft — net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
Microsoft · Not classified by connected sources
EVRS 0 of 100 Informational
Monitor
Rank 2,875 of 2,960 tracked
Why it scores 0
Evidence available: 2 of 8 signalsNo strong exploitation, disclosure, or severity signal is available for this CVE yet.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationNo data
- EPSSDid not apply
- Microsoft Exploitability IndexNo data
- Pre-patch disclosureNo data
- KEV recencyNo data
- CVSSNo data
The band answers “how soon”, not “how bad”. No data for: Ransomware, Vendor exploitation, Microsoft Exploitability Index, Pre-patch disclosure, KEV recency, CVSS. Why some signals show no data
Fix
No fixed version identified yetAffected versions
Not identified by the connected sources
Remediation
NVD lists one or more references for this CVE that aren't tagged as a patch or vendor advisory. Review them directly to confirm patch availability and applicability before making a remediation decision.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | Not publishedNVD and the CVE record were checked and hold no score. | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.002 (9th pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 0.0, assigned by Linux. | Listed | ENISA EUVD |
Description
NVDIn the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs. Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later added the barrier, but only fixed page_pool_recycle_in_ring(). Move the update back under the lock.