Lock Class Vulnerability in Linux Kernel Affects System Stability

CVE-2026-98398

What is CVE-2026-98398?

The Linux kernel has identified a vulnerability related to the locking mechanisms, specifically concerning stale class_cache entries for zapped classes. During operations like module unloading or key unregistration, the kernel may clear class bits without removing all references from ongoing lockdep_map instances. This inconsistency can lead to warnings and potential system instability when locks are acquired. The introduction of lock_class_cache_is_valid() allows for validation of class cache entries to prevent erroneous matching with unrelated classes, addressing both stability and security concerns.

References