CVE-2026-98284

A flaw was found in the Linux kernel's Netlink network communication subsystem. A timing issue (race condition) during socket group memory reallocation allows memory to be freed while concurrent read operations are still accessing it. A local user could exploit this flaw to cause a Denial of Service (DoS) via a system crash or potentially disclose sensitive kernel memory by reading freed or out-of-bounds data.

A race in netlink_realloc_groups can free the old nlk groups bitmap while lockless readers in sk_diag_dump_groups or netlink_native_seq_show are still using it. This creates a use after free read. sk_diag_dump_groups can also pair the old smaller groups pointer with the new larger ngroups value and copy data beyond the old allocation into a NETLINK_DIAG_GROUPS attribute returned to userspace. This provides a plausible local kernel memory disclosure primitive and may also cause a kernel crash if the freed allocation is reused or becomes inaccessible. For the CVSS the PR:L value is selected because a local user or process must manipulate a netlink socket and concurrently invoke a diagnostic or procfs reader. The exact reachability can depend on the netlink protocol, namespace configuration, and permission checks. AC:H is used because reliable triggering requires winning a race between bitmap replacement and a lockless read. The issue is not directly reachable through ordinary remote network packets. Impact includes confidentiality loss through an out of bounds kernel memory read and availability loss through a possible crash. No direct memory write primitive is established, so integrity impact is not assigned. The disclosed kernel data could still assist a separate privilege escalation chain by weakening memory layout protections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.