CVE-2026-98398: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98398 is a Linux kernel vulnerability in the lockdep (lock dependency validator) subsystem, specifically in the locking/lockdep component. The flaw causes lockdep to use stale class_cache[] entries that reference zapped (invalidated) lock classes, leading to kernel warnings and potential instability. It was published on October 14, 2026, and affects Linux kernel versions from 5.1 up to (but not including) the fixed stable releases. The CVSS category is estimated as Medium (Feedly).

The root cause is a use-after-invalidation condition (related to CWE-672: Operation on a Resource After Expiration or Release) in the kernel's lockdep subsystem. When a lock class is zapped — for example, during module unload or key unregistration — zap_class() clears the class's bit in lock_classes_in_use and removes it from the class hash table, but does not invalidate corresponding class_cache[] entries in existing lockdep_map instances embedded in data structures. When __lock_acquire() subsequently runs on such a lock, it finds lock->class_cache[subclass] != NULL, skips register_lock_class(), and assigns hlock->class_idx to the index of the now-zapped class. This causes hlock_class() to hit DEBUG_LOCKS_WARN_ON(1) due to an invalid class_idx, as reported by syzbot in a WireGuard workqueue context (Feedly).

Successful triggering of this vulnerability results in kernel warning splats (DEBUG_LOCKS_WARN_ON) and potential kernel instability or crashes, impacting system availability. The vulnerability primarily affects the integrity of the kernel's lock validation logic rather than enabling direct privilege escalation or data exfiltration. Systems running affected kernel versions with lockdep enabled (typically debug/development kernels) are most at risk, though production kernels with lockdep compiled in could also be affected (Feedly).

There are no known public proof-of-concept exploits, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-98398. The vulnerability was identified via syzbot (Google's kernel fuzzer) and is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score data is currently available given the recent disclosure date (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches. The following versions contain the patch and are unaffected:

• 5.15.222 and later (5.15.x branch)
• 6.1.189 and later (6.1.x branch)
• 6.6.158 and later (6.6.x branch)
• 6.12.111 and later (6.12.x branch)
• 6.18.53 and later (6.18.x branch)
• 7.2.7 and later (7.2.x branch)
• 7.3-rc2 and later

The fix invalidates stale class_cache[] entries when a lock class is zapped, preventing __lock_acquire() from using a dangling class reference. Administrators should update to a patched kernel version as soon as possible (Feedly).