CVE-2026-98804

In the Linux kernel, the following vulnerability has been resolved:

net: page pool: fix use-after-free in page pool recycle ring bulk()

With CONFIG PAGE POOL STATS=y, page pool recycle ring bulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page pool release() can pass its producer-lock barrier and free the pool before recycle stat add() runs.

Commit fcc680a647ba7 ("page pool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("page pool: Fix use-after-free in page pool recycle in ring") later added the barrier, but only fixed page pool recycle in ring(). Move the update back under the lock.