Linux Kernel ipset: Locking flaw in netfilter RCU handling
Summary
A locking correctness flaw in the ipset component of the Linux kernel netfilter subsystem affects how RCU read locks are used when reference counters are changed and during garbage collection in the hash set types. The CNA record describes a locking problem and does not state a concrete security impact. Per the CNA CVSS vector, an attacker needs a local account with low privileges and no user interaction, and the impact is rated high for confidentiality, integrity and availability.
Affected
- Linux kernel versions with the netfilter ipset code from the affected commit range (CNA record lists 5.4.24 to before 5.5 and 5.5.8 to before 5.6, and states affected from 5.6 onward until the fixed stable releases; ranges not fully verified)
- Fixed stable branches per third-party data: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53 (not verified against kernel.org)
Fixed in
- Upstream fix commits: 0c46c9ce24130657ec7460c27fba5d445f5abd06, 5d0c22e73656d050daffad10a2ba8765ce8441c8, 67bd3d2350d17c2f4fb158c3f917c10b15ecbc94, 892399abd1a005a455d5b74d86d82b9773405f2b, ca9fab1ca15534cef1630e81a479e94b3bbcdb6a, ecb48c6b9edc78de8dd456c365727ae14b88c1ee, eee5172741b2c0e73210020732043e5d589295d3
- Distribution fixes: Alpaquita linux-lts 6.1.189-r0, 6.12.111-r0, 6.18.53-r0 (per OSV)
- Ubuntu: status 'Needs evaluation' at time of research; check your distribution tracker for the fixed package version
Workaround
Unknown.
Exploitation
- No known exploitation.
- No CISA KEV entry, exploitation report or public proof of concept found in the research. This does not prove that no exploit exists.
Our recommendation
- Check whether your Linux systems use ipset and whether untrusted local users or shared accounts exist.
- Apply the kernel update from your distribution with the next maintenance window, sooner on multi-user hosts, and reboot to activate the new kernel.
- Check your distribution security tracker for the fixed package version.
- Limit local shell access and restrict who can manage firewall sets as additional hardening.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 0c46c9ce git.kernel.org
- Linux kernel stable commit 5d0c22e7 git.kernel.org
- Linux kernel stable commit 67bd3d23 git.kernel.org
- NVD via Vulners vulners.com
- OSV via Vulners vulners.com
- Ubuntu CVE tracker ubuntu.com
- Alpaquita OSV advisory BELL-CVE-2026-98899 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:41.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
NVD references (7)
- https://git.kernel.org/stable/c/0c46c9ce24130657ec7460c27fba5d445f5abd06
- https://git.kernel.org/stable/c/5d0c22e73656d050daffad10a2ba8765ce8441c8
- https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94
- https://git.kernel.org/stable/c/892399abd1a005a455d5b74d86d82b9773405f2b
- https://git.kernel.org/stable/c/ca9fab1ca15534cef1630e81a479e94b3bbcdb6a
- https://git.kernel.org/stable/c/ecb48c6b9edc78de8dd456c365727ae14b88c1ee
- https://git.kernel.org/stable/c/eee5172741b2c0e73210020732043e5d589295d3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.