CVE-2026-97901 (GCVE-0-2026-97901)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and remain pending after the initial request. Netlink pins the module which owns the dump callback, but in this case that is the controller's owner rather than the target family's owner. The target family can consequently be unregistered and its module unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module. Take a reference to the target family's module when the dump starts. Drop it from the error and done paths. This matches the lifetime for which the dump context retains the family and policy pointers.
References
Impacted products
Vendor Product Version
Linux Linux Version: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7
Version: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7
Version: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7
Version: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7
Version: d07dcf9aadd6b2842b439e8668ff7ea2873f28d7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/genetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a345d95e59a99e25404138b5a1ec2edcb03269f",
              "status": "affected",
              "version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
              "versionType": "git"
            },
            {
              "lessThan": "6e4d746e55c83c240cffce92356763d16b236af5",
              "status": "affected",
              "version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
              "versionType": "git"
            },
            {
              "lessThan": "508387ad95ef9c13aa6431678c39763e882da2dc",
              "status": "affected",
              "version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
              "versionType": "git"
            },
            {
              "lessThan": "6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e",
              "status": "affected",
              "version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
              "versionType": "git"
            },
            {
              "lessThan": "6a1094c34d176827b2b173e163dcc964a13af93f",
              "status": "affected",
              "version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/genetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller\u0027s policy dump keeps pointers to the target\nfamily\u0027s operation and policy tables in its callback state.  A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller\u0027s owner rather than the target family\u0027s owner.  The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending.  Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family\u0027s module when the dump starts.\nDrop it from the error and done paths.  This matches the lifetime for which\nthe dump context retains the family and policy pointers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:53:31.195Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1a345d95e59a99e25404138b5a1ec2edcb03269f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e4d746e55c83c240cffce92356763d16b236af5"
        },
        {
          "url": "https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f"
        }
      ],
      "title": "genetlink: pin family module during policy dump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97901",
    "datePublished": "2026-09-25T10:22:28.655Z",
    "dateReserved": "2026-09-25T10:18:58.200Z",
    "dateUpdated": "2026-10-21T12:53:31.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.