# CVE-2026-98284: netlink: do not free nlk->groups while lockless readers can use it

CVE-2026-98284 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98284 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98284
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98284

## Description

In the Linux kernel, the following vulnerability has been resolved:  netlink: do not free nlk->groups while lockless readers can use it  netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately.  Two readers of nlk->groups / nlk->ngroups do not hold the netlink table lock:  1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the    rhashtable walk in __netlink_diag_dump(), which only holds RCU.    Only the mc_list part of the dump takes nl_table_lock.  2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been    lockless since commit 21e4902aea80 ("netlink: Lockless lookup with    RCU grace period in socket release").  Both can read a freed buffer, and sk_diag_dump_groups() can also read past the end of the old (smaller) buffer if it happens to load the old @groups pointer together with the new @ngroups value, copying the result into a NETLINK_DIAG_GROUPS attribute.  This is the same class of bug that commit f773608026ee ("netlink: access nlk groups safely in netlink bind and getname") fixed for bind() and getname(); these two readers were missed. Simply grabbing the table lock in sk_diag_dump_groups() is not an option, because it is also called with nl_table_lock already held from the mc_list section of the dump.  Make the lockless readers safe instead:  - Allocate a new bitmap and free the old one after an RCU grace period,   instead of relying on the implicit kfree() done by krealloc().  - Publish @groups before @ngroups, both with release semantics, and have   the lockless readers load @ngroups first. A reader can then never pair   the new (bigger) size with the old (smaller) buffer, and a reader   picking up the new pointer while still seeing the old size is   guaranteed to see the initialized bitmap.  netlink_realloc_groups() is called from process context (bind() and setsockopt()), so kfree_rcu_mightsleep() can be used, once the table has been released.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98284](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98284.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.