{"metadata": {"vulnerability": "CVE-2026-98398", "count": 28, "kinds": {"milestone": 12, "sighting": 1, "kev": 0, "other": 15}}, "data": [{"timestamp": "2026-09-25T10:25:14.346Z", "date_only": false, "value": "2026-09-25T10:25:14.346Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98398", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98398", "record": "UBUNTU-CVE-2026-98398", "field": "published"}, {"timestamp": "2026-10-14T13:25:59.676Z", "date_only": false, "value": "2026-10-14T13:25:59.676Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98398", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:50Z", "date_only": false, "value": "2026-10-14T14:17:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QFC6-3G3R-6RJJ", "record": "GHSA-QFC6-3G3R-6RJJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T14:17:50.760Z", "date_only": false, "value": "2026-10-14T14:17:50.760", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98398", "record": "FKIE_CVE-2026-98398", "field": "published"}, {"timestamp": "2026-10-14T15:32:19Z", "date_only": false, "value": "2026-10-14T15:32:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QFC6-3G3R-6RJJ", "record": "GHSA-QFC6-3G3R-6RJJ", "field": "published"}, {"timestamp": "2026-10-14T15:32:19Z", "date_only": false, "value": "2026-10-14T15:32:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QFC6-3G3R-6RJJ", "record": "GHSA-QFC6-3G3R-6RJJ", "field": "modified"}, {"timestamp": "2026-10-14T18:30:48.136Z", "date_only": false, "value": "2026-10-14T18:30:48.136638Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440685515958648", "record": "CVE-2026-98398", "field": "creation_timestamp", "uuid": "67857f34-6e8e-4f92-b7d9-de167329b529", "content": "CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes In the Linux kernel, the following vulnerability has been resolved:\nlocking/lockdep: Invalidate stale class_cache entries for zapped classes\nsyzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_ON(1) inhlock_class() due to an invalid class_idx:\n  WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x382/0x2cf0 kernel/locking/lockdep.c:5203  Workqueue: wg-crypt-wg0 wg_packet_tx_worker  RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline]  RIP: 0010:check_wait_context kernel/locking/lockdep.c:4870 [inline]  RIP: 0010:__lock_acquire+0x389/0x2cf0 kernel/locking/lockdep.c:5203  Call Trace:   <IRQ>   lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886   _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173   tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291   tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325   ...\nWhen a lock class is zapped (e.g. during module unload or keyunregistration), zap_class() clears the class's bit inlock_classes_in_use and removes it from the class hash table.However, existing lockdep_map instances embedded in data structuresmay still retain a pointer to the zapped class in their class_cache[]array.\nWhen __lock_acquire() subsequently runs on such a lock, it findslock->class_cache[subclass] != NULL, skipping register_lock_class()and assigning hlock->class_idx to the index of the zapped class. Whencheck_wait_context() or hlock_class() inspects the held_lock, it finds!test_bit(class_idx, lock_classes_in_use) and warns. Furthermore, ifthe zapped slot is subsequently re-allocated to an unrelated lock key,the stale class_cache entry would erroneously match the unrelatedclass (ABA issue).\nAdd lock_class_cache_is_valid() to validate that the cached class iswithin lock_classes bounds, still allocated in lock_classes_in_use(using uninstrumented arch_test_bit() in __always_inline context so itis safe in noinstr contexts like match_held_lock()), and thatclass->key matches the expected subkey (taking lockdep_set_subclass()overrides into account). Also use READ_ONCE()/WRITE_ONCE() whenaccessing class_cache[].  If the entry is invalid or stale, fall backto register_lock_class() / look_up_lock_class().\nhttps://www.cve.org/CVERecord?id=CVE-2026-98398https://git.kernel.org/stable/c/f8a1281ab82df5b51fd0384354d4b21daf2b7af0https://git.kernel.org/stable/c/1c9d664e2e067fca69e5a41d68e23bbc66a583fehttps://git.kernel.org/stable/c/6bc345f6d81ebe22e0f355c2a21d7e29691f9332https://git.kernel.org/stable/c/f63c86e9d267629758adaba18579e784ddd63c32https://git.kernel.org/stable/c/c7acfb04c7e2e2dea248282b21373d93296644ddhttps://git.kernel.org/stable/c/baa320fbb2f9fea50f5632a307da8ce84fbef5bdhttps://git.kernel.org/stable/c/02c6be7d675b21d81f0ba3a524346850a8c0e3bf#kernel #Linux#CVE_2026_98398#bot", "url": "https://infosec.exchange/users/cve/statuses/117440685515958648"}, {"timestamp": "2026-10-16T01:05:34Z", "date_only": false, "value": "2026-10-16T01:05:34.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98398", "record": "MSRC_CVE-2026-98398", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T01:05:34Z", "date_only": false, "value": "2026-10-16T01:05:34.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98398", "record": "MSRC_CVE-2026-98398", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-16T06:05:38.212Z", "date_only": false, "value": "2026-10-16T06:05:38.21257Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98398", "record": "BELL-CVE-2026-98398", "field": "published"}, {"timestamp": "2026-10-16T06:42:47.284Z", "date_only": false, "value": "2026-10-16T06:42:47.284811Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98398", "record": "BELL-CVE-2026-98398", "field": "modified"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": true, "value": "2026-10-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1375", "record": "CERTFR-2026-AVI-1375", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-19T09:18:51.739Z", "date_only": false, "value": "2026-10-19T09:18:51.739Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98398", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T09:18:51.739Z", "date_only": false, "value": "2026-10-19T09:18:51.739Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98398", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:18:44.480Z", "date_only": false, "value": "2026-10-19T10:18:44.480", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98398", "record": "FKIE_CVE-2026-98398", "field": "lastModified"}, {"timestamp": "2026-10-20T14:21:49Z", "date_only": false, "value": "2026-10-20T14:21:49Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98398", "record": "UBUNTU-CVE-2026-98398", "field": "modified"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-21T18:42:05Z", "date_only": false, "value": "2026-10-21T18:42:05.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98398", "record": "MSRC_CVE-2026-98398", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-21T18:42:05Z", "date_only": false, "value": "2026-10-21T18:42:05.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98398", "record": "MSRC_CVE-2026-98398", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-21T20:21:03.800Z", "date_only": false, "value": "2026-10-21T20:21:03.800Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98398", "record": "MSRC_CVE-2026-98398", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": true, "value": "2026-10-22", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1375", "record": "CERTFR-2026-AVI-1375", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1375", "record": "CERTFR-2026-AVI-1375", "field": "last_revision_date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1375", "record": "CERTFR-2026-AVI-1375", "field": "initial_release_date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1375", "record": "CERTFR-2026-AVI-1375", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "last_revision_date"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "initial_release_date"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "revisions.0.revision_date"}]}