CVE-2026-98555
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
50/100
Published: 2026-10-18
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.