[CVE-2026-97901][MODERATE 7.0] genetlink: pin family module during policy dump [ Upstream

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-97901
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: genetlink: pin family module during policy dump [ Upstream
Commit: 508387ad95ef9c13aa6431678c39763e882da2dc
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901
Analysis date: Sat, 26 Sep 2026 15:10:55 -0400
ActionableScore: 4
ActionableScore lower bound: unknown
Actionable bucket: Borderline / manual review recommended
Manual review required: YES

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-97901 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-97901	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-97901 CHECK WITH IMPACT FROM ORIG NN MODERATE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H';BEST CVSS score: '5.8';DESCR 'A use after free in the Generic Netlink policy dump path occurs because a pending dump retains pointers to a target family policy and operation tables without pinning the target family module. If that module is unregistered and unloaded before the dump continues, a later dump callback can dereference memory belonging to the unloaded module. This can cause a local kernel crash and may permit limited information disclosure if freed memory is reused and exposed through the dump response. For the CVSS the paranoid score uses PR:L because a local user can initiate and retain the dump, although reliably creating the module unload condition normally requires separate administrative control. The issue is not network reachable because Generic Netlink is a local kernel interface. Impact is at least local denial of service via kernel crash. Limited confidentiality or integrity impact is possible in the paranoid assessment due to the UAF and should be reviewed manually.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 4)	YES	DANGER NOMEMCHK SIMPLEFIX LINUS KPANIC 	NO	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=4
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=RECOMMENDED
AutoDowngradeAllowed=YES

1. ActionableScore

* Raw conservative score: 4
* Conservative score: 4
* Raw paranoid score: 4
* Paranoid score: 4
* Final recommended bucket: **Borderline / manual review recommended**::

2. Signal breakdown

* +2 Real UAF or lifetime violation. A pending Generic Netlink policy dump stores pointers to the target genl family and its policy or operation tables. The target module can be unloaded before dump continuation, and later callback processing dereferences memory formerly owned by that module.
* +1 Reliable kernel crash or strong DoS. Dereferencing unloaded module memory can cause a kernel page fault or Oops when the dump advances.
* +1 Local unprivileged trigger. Generic Netlink controller policy-dump requests are normally local netlink requests and the supplied context does not show a capability check for starting the dump.
* No hard-race penalty. The dump is explicitly designed to remain pending across multiple skb responses. The required unload ordering is a lifetime race, but the supplied evidence does not establish a uniquely narrow or externally uncontrollable timing window.
* No host-admin penalty. Unloading a module normally involves host-level administrative control, but the supplied evidence does not establish that the same attacker must perform the unload rather than exploiting an independently occurring unregister or unload event.
* Controlled reclaim not demonstrated. The stale data is policy and operation metadata in unloaded module memory, not a demonstrated attacker-controlled slab object replacement.
* Arbitrary or directed kernel write not demonstrated.
* Confidentiality impact not awarded. The patch establishes an invalid dereference, but does not establish that stale module memory is successfully serialized into a userspace netlink response.
* Integrity impact not awarded. No write through the stale policy or operation pointers is established.
* Structured stale-object exploitation leverage not awarded. The stale references are consumed by policy dump processing, but attacker-controlled post-free replacement fields, callback control, or meaningful active-object reuse are not shown.
* Concrete repeated release or refcount mutation not present. The added module_put is paired with the newly added try_module_get and is not a second release through a dangling target-family reference.
* Extra Availability point not awarded. The crash consequence is already counted once.
* Remote reachability not established. Generic Netlink is a local kernel interface and no remote packet path reaches this dump operation directly.

3. Reachability analysis

The immediate entry point is a Generic Netlink controller policy dump. A local process can normally request Generic Netlink controller information without host-admin-equivalent privileges, so it can plausibly create the pending dump state.

The complete UAF sequence additionally requires the selected target Generic Netlink family to be unregistered and its owning module to be unloaded before the multipart dump resumes. Module unloading is normally host-global and controlled through module-management authority such as CAP_SYS_MODULE. However, the supplied patch does not prove whether the attacker must directly cause the unload, whether a target module may be removed by an independently occurring lifecycle event, or whether a product-specific service exposes such an operation to a reduced-privilege actor.

The complete operation is not shown to be namespace-scoped. A network namespace may scope some Generic Netlink use, but module ownership, family registration, and module unloading are not established as fully attacker-reachable namespace-local operations. No hardware, boot option, or special device prerequisite is shown.

4. Primitive and severity interpretation

The exact primitive is a real use after free or stale post-lifetime dereference of target-family policy and operation-table memory. The pending dump callback retains target-module pointers after the target module can be unloaded. The stale storage is closer to fixed unloaded-module data than to an attacker-reclaimable active heap object.

This is not a concrete repeated release or refcount corruption case. The vulnerable continuation reads or traverses stale policy-related data. The patch does not show a second put, release, free, or refcount decrement through the stale target-family pointer.

The demonstrated consequence is local kernel crash or DoS. A stronger consequence such as disclosure through malformed dump serialization is possible only as an unresolved hypothesis and is not established by the supplied patch. No controlled reclaim, post-free attacker-controlled contents, arbitrary read or write, callback dispatch, security-boundary bypass, or privilege escalation primitive is demonstrated.

PrimitiveClass is CLASS_B because an actual kernel lifetime violation and stale dereference exist. ImportantCandidate is NO because the currently demonstrated stale use is constrained to policy-dump metadata after module unload, without meaningful post-free reuse or write-like lifetime mutation. AutoDowngradeAllowed is YES because the supplied evidence supports a constrained crash-capable UAF rather than an unresolved active-object corruption primitive with substantial exploitation leverage.

Likely operational severity is Borderline Moderate. It merits targeted confirmation on systems that allow target family modules to be unloaded while Generic Netlink policy dumps can remain in flight.

5. One-sentence report phrase

A pending Generic Netlink policy dump can retain pointers to a target family module after the module is unloaded, causing a local use after free that can crash the kernel when dump processing resumes.

6. Manual review recommendation

MANUAL CHECK RECOMMENDED

Confirm whether affected Generic Netlink family modules are unloadable in the evaluated product, whether unprivileged users can request the relevant policy dump, and whether policy-dump continuation can expose stale memory rather than faulting immediately.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: genetlink: pin family module during policy dump [ Upstream
Commit: 508387ad95ef9c13aa6431678c39763e882da2dc
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc

Changed files:
  net/netlink/genetlink.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-97901 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS score: 5.8

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 4

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).