From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-97901][MODERATE 7.0] genetlink: pin family module during policy dump [ Upstream Date: Sat, 26 Sep 2026 15:10:55 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-97901 X-AL-KERNEL-Priority: MODERATE 7.0 X-AL-KERNEL-Severity: MODERATE 7.0 X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: YES X-AL-KERNEL-ActionableScore: 4 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: 508387ad95ef9c13aa6431678c39763e882da2dc List-Id: CVE: CVE-2026-97901 Priority: MODERATE 7.0 AL-KERNEL base severity: MODERATE KPANIC flag: YES Patch: genetlink: pin family module during policy dump [ Upstream Commit: 508387ad95ef9c13aa6431678c39763e882da2dc Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901 Analysis date: Sat, 26 Sep 2026 15:10:55 -0400 ActionableScore: 4 ActionableScore lower bound: unknown Actionable bucket: Borderline / manual review recommended Manual review required: YES Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97901 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE 7.0 Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-97901 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-97901 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H';BEST CVSS score: '5.8';DESCR 'A use after free in the Generic Netlink policy dump path occurs because a pending dump retains pointers to a target family policy and operation tables without pinning the target family module. If that module is unregistered and unloaded before the dump continues, a later dump callback can dereference memory belonging to the unloaded module. This can cause a local kernel crash and may permit limited information disclosure if freed memory is reused and exposed through the dump response. For the CVSS the paranoid score uses PR:L because a local user can initiate and retain the dump, although reliably creating the module unload condition normally requires separate administrative control. The issue is not network reachable because Generic Netlink is a local kernel interface. Impact is at least local denial of service via kernel crash. Limited confidentiality or integrity impact is possible in the paranoid assessment due to the UAF and should be reviewed manually.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 4) YES DANGER NOMEMCHK SIMPLEFIX LINUS KPANIC NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=4 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=NO ManualReview=RECOMMENDED AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: 4 * Conservative score: 4 * Raw paranoid score: 4 * Paranoid score: 4 * Final recommended bucket: **Borderline / manual review recommended**:: 2. Signal breakdown * +2 Real UAF or lifetime violation. A pending Generic Netlink policy dump stores pointers to the target genl family and its policy or operation tables. The target module can be unloaded before dump continuation, and later callback processing dereferences memory formerly owned by that module. * +1 Reliable kernel crash or strong DoS. Dereferencing unloaded module memory can cause a kernel page fault or Oops when the dump advances. * +1 Local unprivileged trigger. Generic Netlink controller policy-dump requests are normally local netlink requests and the supplied context does not show a capability check for starting the dump. * No hard-race penalty. The dump is explicitly designed to remain pending across multiple skb responses. The required unload ordering is a lifetime race, but the supplied evidence does not establish a uniquely narrow or externally uncontrollable timing window. * No host-admin penalty. Unloading a module normally involves host-level administrative control, but the supplied evidence does not establish that the same attacker must perform the unload rather than exploiting an independently occurring unregister or unload event. * Controlled reclaim not demonstrated. The stale data is policy and operation metadata in unloaded module memory, not a demonstrated attacker-controlled slab object replacement. * Arbitrary or directed kernel write not demonstrated. * Confidentiality impact not awarded. The patch establishes an invalid dereference, but does not establish that stale module memory is successfully serialized into a userspace netlink response. * Integrity impact not awarded. No write through the stale policy or operation pointers is established. * Structured stale-object exploitation leverage not awarded. The stale references are consumed by policy dump processing, but attacker-controlled post-free replacement fields, callback control, or meaningful active-object reuse are not shown. * Concrete repeated release or refcount mutation not present. The added module_put is paired with the newly added try_module_get and is not a second release through a dangling target-family reference. * Extra Availability point not awarded. The crash consequence is already counted once. * Remote reachability not established. Generic Netlink is a local kernel interface and no remote packet path reaches this dump operation directly. 3. Reachability analysis The immediate entry point is a Generic Netlink controller policy dump. A local process can normally request Generic Netlink controller information without host-admin-equivalent privileges, so it can plausibly create the pending dump state. The complete UAF sequence additionally requires the selected target Generic Netlink family to be unregistered and its owning module to be unloaded before the multipart dump resumes. Module unloading is normally host-global and controlled through module-management authority such as CAP_SYS_MODULE. However, the supplied patch does not prove whether the attacker must directly cause the unload, whether a target module may be removed by an independently occurring lifecycle event, or whether a product-specific service exposes such an operation to a reduced-privilege actor. The complete operation is not shown to be namespace-scoped. A network namespace may scope some Generic Netlink use, but module ownership, family registration, and module unloading are not established as fully attacker-reachable namespace-local operations. No hardware, boot option, or special device prerequisite is shown. 4. Primitive and severity interpretation The exact primitive is a real use after free or stale post-lifetime dereference of target-family policy and operation-table memory. The pending dump callback retains target-module pointers after the target module can be unloaded. The stale storage is closer to fixed unloaded-module data than to an attacker-reclaimable active heap object. This is not a concrete repeated release or refcount corruption case. The vulnerable continuation reads or traverses stale policy-related data. The patch does not show a second put, release, free, or refcount decrement through the stale target-family pointer. The demonstrated consequence is local kernel crash or DoS. A stronger consequence such as disclosure through malformed dump serialization is possible only as an unresolved hypothesis and is not established by the supplied patch. No controlled reclaim, post-free attacker-controlled contents, arbitrary read or write, callback dispatch, security-boundary bypass, or privilege escalation primitive is demonstrated. PrimitiveClass is CLASS_B because an actual kernel lifetime violation and stale dereference exist. ImportantCandidate is NO because the currently demonstrated stale use is constrained to policy-dump metadata after module unload, without meaningful post-free reuse or write-like lifetime mutation. AutoDowngradeAllowed is YES because the supplied evidence supports a constrained crash-capable UAF rather than an unresolved active-object corruption primitive with substantial exploitation leverage. Likely operational severity is Borderline Moderate. It merits targeted confirmation on systems that allow target family modules to be unloaded while Generic Netlink policy dumps can remain in flight. 5. One-sentence report phrase A pending Generic Netlink policy dump can retain pointers to a target family module after the module is unloaded, causing a local use after free that can crash the kernel when dump processing resumes. 6. Manual review recommendation MANUAL CHECK RECOMMENDED Confirm whether affected Generic Netlink family modules are unloadable in the evaluated product, whether unprivileged users can request the relevant policy dump, and whether policy-dump continuation can expose stale memory rather than faulting immediately. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: genetlink: pin family module during policy dump [ Upstream Commit: 508387ad95ef9c13aa6431678c39763e882da2dc Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc Changed files: net/netlink/genetlink.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=508387ad95ef9c13aa6431678c39763e882da2dc ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97901 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97901 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H The Best / paranoid CVSS score: 5.8 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 4 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: YES Published priority for this report (same as in Subject): MODERATE 7.0 These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).