CVE-2026-98284

Executive Summary

CVE-2026-98284 is a use-after-free and out-of-bounds read vulnerability in the Linux kernel's netlink subsystem, specifically in netlink_realloc_groups(). The flaw allows lockless readers of nlk->groups and nlk->ngroups to access a freed or truncated bitmap buffer when the groups array is reallocated into a different kmalloc bucket. All Linux kernel deployments using netlink sockets are potentially affected. Successful exploitation can lead to information disclosure via the NETLINK_DIAG_GROUPS attribute or denial of service through kernel memory corruption.

Technical Analysis

The vulnerability resides in netlink_realloc_groups(), which uses krealloc() under netlink_table_grab(). When the size of the groups bitmap (NLGRPSZ(groups)) transitions into a different kmalloc bucket, the old bitmap is freed immediately. Two specific readers access nlk->groups and nlk->ngroups without holding the netlink table lock:

1. sk_diag_dump_groups(): Invoked during a rhashtable walk in __netlink_diag_dump(), which operates under RCU protection only. The nl_table_lock is acquired solely for the mc_list portion of the dump. This function can read past the end of the old, smaller buffer if it loads the old groups pointer alongside the new ngroups value. The out-of-bounds data is copied into a NETLINK_DIAG_GROUPS attribute and returned to userspace.

2. netlink_native_seq_show(): Used for /proc/net/netlink. This walk has been lockless since commit 21e4902aea80 ("netlink: Lockless lookup with RCU grace period in socket release"). It can read a freed buffer.

This is the same class of bug previously fixed by commit f773608026ee ("netlink: access nlk groups safely in netlink bind and getname"), which addressed bind() and getname(). The current issue affects the two readers that were missed. The fix approach involves allocating a new bitmap and deferring the free of the old one until after an RCU grace period, rather than freeing immediately. Grabbing the table lock in sk_diag_dump_groups() is not viable because it is already called with nl_table_lock held from the mc_list section of the dump, creating a deadlock risk.

The attack surface is local: an attacker must be able to trigger netlink group reallocation (e.g., via socket option changes that alter group membership) and concurrently invoke the diagnostic interfaces. The race window is between the reallocation and the lockless reads.

Exploitation Scenarios

No public PoC or exploit code is available. The following attack chain is inferred from the vulnerability class (use-after-free / race condition in kernel memory management) and the specific reader functions named in the NVD description.

1. Reconnaissance and target identification: The attacker identifies a Linux system with a kernel version vulnerable to CVE-2026-98284. This is a local attack requiring the ability to create or manipulate netlink sockets. The attacker must have a user account with permission to open netlink sockets and access diagnostic interfaces (/proc/net/netlink or netlink diag sockets).

2. Triggering the flaw class: The attacker initiates operations that cause netlink_realloc_groups() to reallocate the groups bitmap into a different kmalloc bucket. This is typically achieved by modifying the netlink socket's group subscriptions (e.g., via setsockopt with NETLINK_ADD_MEMBERSHIP or similar, though exact parameters are not specified in the description). Concurrently, the attacker triggers the lockless readers:

   • sk_diag_dump_groups() via a netlink diagnostic dump request (e.g., NETLINK_DIAG socket).
   • netlink_native_seq_show() by reading /proc/net/netlink.

3. Payload/execution method: The race condition causes the reader to access the old groups pointer after it has been freed or to read beyond the end of the old buffer using the new ngroups value. For sk_diag_dump_groups(), the out-of-bounds data is copied into a NETLINK_DIAG_GROUPS attribute and returned to the user. For netlink_native_seq_show(), the freed memory is read and displayed via /proc/net/netlink. No specific payload is required beyond triggering the race; the impact is information disclosure or memory corruption.

4. Post-exploitation impact: The primary impact is information disclosure (leaking kernel heap contents, potentially including pointers or sensitive data) and denial of service (kernel crash due to use-after-free). In severe cases, the use-after-free could be leveraged for privilege escalation if the freed memory is reallocated with attacker-controlled data, though this requires precise heap grooming and is not demonstrated in the available data.

Impact Assessment

• Confidentiality: High — kernel heap memory contents can be leaked via NETLINK_DIAG_GROUPS or /proc/net/netlink, potentially exposing sensitive data such as kernel pointers (which can bypass KASLR) or other process information.
• Integrity: Low — the vulnerability itself does not directly allow data modification, but a use-after-free could be leveraged for privilege escalation with further exploitation.
• Availability: High — a use-after-free read can cause a kernel panic, leading to denial of service.
• Attack Vector: Local — the attacker must have local access to the system to create netlink sockets and read diagnostic interfaces.
• Attack Complexity: High — exploiting the race condition requires precise timing and may be difficult to trigger reliably.
• Privileges Required: Low — a standard user account with netlink socket access is sufficient.
• User Interaction: None.
• Scope: Unchanged — the vulnerability is confined to the kernel's netlink subsystem.
• Blast Radius: All Linux systems running an unpatched kernel with netlink enabled (default in most distributions) are at risk. Multi-tenant systems and container hosts are particularly exposed because a local user in one container could potentially trigger the flaw and impact the host kernel.
• CVSS Score: Not officially assigned. The inferred vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H, reflecting a local, high-complexity attack that requires low privileges and results in high confidentiality and availability impact.

Detection Guidance

Sigma Rule

title: Linux Kernel Netlink Groups Use-After-Free Exploitation Attempt
id: 9b8c7d6e-5f4a-3b2c-1d0e-9f8a7b6c5d4e
status: experimental
description: Detects attempts to exploit CVE-2026-98284 by triggering netlink group reallocation and concurrent diagnostic reads.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98284
author: Threat Intelligence Team
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection_netlink_diag:
    type: SYSCALL
    syscall: socket
    a0: 'AF_NETLINK'
  selection_proc_netlink:
    type: SYSCALL
    syscall: open
    a1|endswith: '/proc/net/netlink'
  condition: selection_netlink_diag or selection_proc_netlink
falsepositives:
  - Legitimate network monitoring tools
  - System diagnostics
level: medium

YARA Rule

rule CVE_2026_98284_Netlink_UAF
{
    meta:
        description = "Detects potential exploitation of CVE-2026-98284 in Linux kernel netlink groups"
        author = "Threat Intelligence Team"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98284"
        severity = "high"

    strings:
        $netlink_diag = "NETLINK_DIAG_GROUPS" ascii wide
        $proc_netlink = "/proc/net/netlink" ascii wide
        $netlink_realloc = "netlink_realloc_groups" ascii wide
        $krealloc = "krealloc" ascii wide

    condition:
        (uint16(0) == 0x457f) and // ELF file
        (
            (any of ($netlink_diag*)) or
            (any of ($proc_netlink*)) or
            (any of ($netlink_realloc*)) or
            (any of ($krealloc*))
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98284 Linux Kernel Netlink Groups Use-After-Free Attempt"; flow:to_server; content:"|00 00|"; depth:2; byte_test:1,>,0,0; byte_test:1,<32,0; byte_jump:1,0,relative; content:"|00 00 00 00|"; within:4; distance:0; sid:202698284; rev:1; reference:cve,2026-98284; classtype:attempted-admin; priority:2;)

Elastic Detection

process where event.type == "start" and
  process.name in ("ss", "netstat", "ip", "cat") and
  process.args : ("/proc/net/netlink", "-A", "-x", "netlink") and
  process.parent.name not in ("systemd", "cron", "init")

Splunk SPL Query

index=linux sourcetype=auditd
| search (syscall="socket" AND a0="AF_NETLINK") OR (syscall="open" AND path="/proc/net/netlink")
| stats count by host, process, user, syscall, path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="linux,cve_2026_98284,netlink">
  <rule id="10098284" level="10">
    <decoded_as>auditd</decoded_as>
    <field name="syscall">socket</field>
    <field name="a0">AF_NETLINK</field>
    <description>CVE-2026-98284: Linux netlink socket creation detected - possible exploitation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="10098285" level="8">
    <decoded_as>auditd</decoded_as>
    <field name="syscall">open</field>
    <field name="path">/proc/net/netlink</field>
    <description>CVE-2026-98284: Access to /proc/net/netlink detected - potential lockless reader race exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate mitigations:

   • Restrict local access to systems running vulnerable kernels. Limit user accounts to trusted personnel only.
   • Disable or restrict access to /proc/net/netlink using mount namespaces or kernel hardening options where possible.
   • Apply the principle of least privilege: reduce the number of local users and processes that can create netlink sockets.
   • Monitor for any kernel panics or OOM events that could indicate exploitation attempts.
   • Use security modules (SELinux, AppArmor) to restrict netlink socket creation and diagnostic interface access for unprivileged processes.

2. Patch/upgrade steps:

   • No official patch is available from any tracked source as of this report.
   • Monitor the Linux kernel mainline repository and your distribution's security advisories for a fix.
   • Once a patched kernel is available, upgrade immediately and reboot to activate the new kernel.
   • For custom kernels, watch for the upstream fix that changes netlink_realloc_groups() to allocate a new bitmap and free the old one after an RCU grace period.

3. Long-term hardening:

   • Enable kernel address space layout randomization (KASLR) to make exploitation harder.
   • Enable CONFIG_SLAB_FREELIST_HARDENED and CONFIG_SLAB_FREELIST_RANDOM to mitigate use-after-free exploitation.
   • Use kernel live patching where available to reduce the window of exposure.
   • Implement mandatory access control policies that restrict netlink diagnostic interfaces to privileged processes.
   • Regularly audit kernel versions across your fleet and maintain a rapid patch deployment capability.

References

• NVD: CVE-2026-98284
• Linux Kernel Commit f773608026ee: netlink: access nlk groups safely in netlink bind and getname
• Linux Kernel Commit 21e4902aea80: netlink: Lockless lookup with RCU grace period in socket release
• CWE-416: Use After Free
• CWE-908: Use of Uninitialized Resource

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-98284. CISA KEV catalog does not list this vulnerability.