Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-98153

Linux kernel: race condition

Risk score
43/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.1%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scan…
Affected
Linux kernel
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Linux kernelTHE FLAWSTHE FIXCVE-2026-98153Race conditionCVSS 5.5 · EPSS 0%CVE-2026-98130Race conditionCVSS 8.1 · EPSS 0%CVE-2026-98115Race conditionCVSS 8.8 · EPSS 0%CVE-2026-98052In the Linux kernel, thefollowing vulnerability has beenresolved: net: bcmasp: clear…CVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLinux kernelAMBER · PATCH THIS WEEKLinux kernelIn the Linux kernel, thefollowing vulnerability has beenresolved: sctp: fix a TOCTOUrace inSCTP_CMD_TIMER_START TheSCTP_CMD_TIMER_STARThandler checks timer_pending()…Where it standsNo known exploitationCONNECTS TOSame weaknessRace condition (CWE-362)92 other warnings in 30 days →Same productEarlier Linux kernel warnings61 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…

The flaws

  • CVE-2026-98153: Race condition (CVSS 5.5 · EPSS 0%)
  • CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
  • CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
  • CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.

Last activity 25 Sep 2026. Patch Forecast updates every hour.