Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-98117

Linux kernel: use-after-free

Risk score
58/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.2%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefiles_coherency() is being passed a pointer to a __be64 lain over the coherency data in struct cachefiles_xattr so that it can display the first 8 bytes. However, the data is of variabl…
Affected
Linux kernel
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Linux kernelTHE FLAWSTHE FIXCVE-2026-98117Use-after-freeCVSS 7.8 · EPSS 0%CVE-2026-98096Out-of-bounds writeCVSS 7.4 · EPSS 1%CVE-2026-98115Race conditionCVSS 8.8 · EPSS 0%CVE-2026-98052In the Linux kernel, thefollowing vulnerability has beenresolved: net: bcmasp: clear…CVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLinux kernelAMBER · PATCH THIS WEEKLinux kernelIn the Linux kernel, thefollowing vulnerability has beenresolved: ipv6: sr: restorenetwork header before routingand forwarding ipv6_srh_rcv()runs with skb->data at theSegment Routing Header (SRH)…Where it standsNo known exploitationCONNECTS TOSame weaknessUse-after-free (CWE-416)400 other warnings in 30 days →Same productEarlier Linux kernel warnings116 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …

The flaws

  • CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)
  • CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
  • CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
  • CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefiles_coherency() is being passed a pointer to a __be64 lain over the coherency data in struct cachefiles_xattr so that it can display the first 8 bytes. However, the data is of variable length and could even be 0 bytes. This could lead to a UAF or KASAN warning. Fix this by making sure the buffer has room for at least 8 bytes and that those 8 bytes are pre-cleared. Further, those bytes are not 8-byte aligned, so fix the tracepoint to extract the data as four 2-byte words (they are 2-byte aligned) and reassemble the __be64. The compiler will convert this into a single 8-byte load where the CPU supports it.

Last activity 25 Sep 2026. Patch Forecast updates every hour.