Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98398— locking/lockdep: Invalidate stale class_cache entries for zapped classes

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： 锁定/lockdep：清除已注销（zapped）锁类的陈旧 class_cache 条目 syzbot 报告了一个 lockdep 警告（splat），该警告在 函数中因无效的 触发了 检查： 当某个锁类被注销（例如，在模块卸载或密钥注销期间）， 会清除 中该类的位，并将其从类哈希表中移除。然而，嵌入在数据结构中的现有 实例仍可能在其 数组中保留指向已注销锁类的指针。 当此类锁随后在 中运行时，它会发现 ，从而跳过 ，并将 赋值为已注销锁类的索引。当 或 检查该持有的锁（h

AI Predicted 5.5 Difficulty: Moderate

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< f8a1281ab82df5b51fd0384354d4b21daf2b7af0 affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< 1c9d664e2e067fca69e5a41d68e23bbc66a583fe affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< 6bc345f6d81ebe22e0f355c2a21d7e29691f9332 affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< f63c86e9d267629758adaba18579e784ddd63c32 affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< c7acfb04c7e2e2dea248282b21373d93296644dd affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< baa320fbb2f9fea50f5632a307da8ce84fbef5bd affected
a0b0fd53e1e67639b303b15939b9c653dbe7a8c4< 02c6be7d675b21d81f0ba3a524346850a8c0e3bf affected
5.1 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
locking/lockdep: Invalidate stale class_cache entries for zapped classes
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale class_cache entries for zapped classes syzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_ON(1) in hlock_class() due to an invalid class_idx: WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x382/0x2cf0 kernel/locking/lockdep.c:5203 Workqueue: wg-crypt-wg0 wg_packet_tx_worker RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4870 [inline] RIP: 0010:__lock_acquire+0x389/0x2cf0 kernel/locking/lockdep.c:5203 Call Trace: <IRQ> lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291 tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325 ... When a lock class is zapped (e.g. during module unload or key unregistration), zap_class() clears the class's bit in lock_classes_in_use and removes it from the class hash table. However, existing lockdep_map instances embedded in data structures may still retain a pointer to the zapped class in their class_cache[] array. When __lock_acquire() subsequently runs on such a lock, it finds lock->class_cache[subclass] != NULL, skipping register_lock_class() and assigning hlock->class_idx to the index of the zapped class. When check_wait_context() or hlock_class() inspects the held_lock, it finds !test_bit(class_idx, lock_classes_in_use) and warns. Furthermore, if the zapped slot is subsequently re-allocated to an unrelated lock key, the stale class_cache entry would erroneously match the unrelated class (ABA issue). Add lock_class_cache_is_valid() to validate that the cached class is within lock_classes bounds, still allocated in lock_classes_in_use (using uninstrumented arch_test_bit() in __always_inline context so it is safe in noinstr contexts like match_held_lock()), and that class->key matches the expected subkey (taking lockdep_set_subclass() overrides into account). Also use READ_ONCE()/WRITE_ONCE() when accessing class_cache[]. If the entry is invalid or stale, fall back to register_lock_class() / look_up_lock_class().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a0b0fd53e1e67639b303b15939b9c653dbe7a8c4 ~ f8a1281ab82df5b51fd0384354d4b21daf2b7af0 -
Linux Linux 5.1 -

II. Public POCs for CVE-2026-98398

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98398

请登录查看更多情报信息。

Other References for CVE-2026-98398 (7)

Same Patch Batch · Linux · 2026-10-14 · 46 CVEs total

CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check
CVE-2026-98389 drm/amdgpu: skip gfx switch_power_profile during GPU reset
CVE-2026-98388 exec: do_close_on_exec() before taking exec_update_lock
CVE-2026-98387 s390/crypto: Fix skcipher_walk return code handling in aes_s390
CVE-2026-98386 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
CVE-2026-98390 x86/amd_node: Avoid divide by zero on virtualized systems
CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block
CVE-2026-98402 net: icmp: avoid invalid transport header access in icmp_send tracepoint
CVE-2026-98401 net: iptunnel: fix stale transport header during tunnel decapsulation
CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line
CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()
CVE-2026-98406 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
CVE-2026-98408 watchdog: rzv2h: Avoid division by zero
CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

Showing top 20 of 46 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98398

No comments yet

Leave a comment