All vulnerabilities
CVE-2026-98555

Linux: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8b855b645841b5a04e20339a22bb6d593c9b790dAlso 060f827aa3dc47939ee306da715cd6700d129616, 41dcae82bece9f106b4dff0ee777bba8d157c8a8 and 1 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8b855b645841b5a04e20339a22bb6d593c9b790dLinuxCVE List
  • 060f827aa3dc47939ee306da715cd6700d129616LinuxCVE List
  • 41dcae82bece9f106b4dff0ee777bba8d157c8a8LinuxCVE List
  • 72f9dd522f8d6c5a00be9695c7bb74631eb5069eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference.

In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error.

Free nskb in all three error paths.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fec0fe6838a7f45175667701fb51abb23a6ffb1eCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b859ba18b5a1067f71db5618c6a4a70d55fa308bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8b855b645841b5a04e20339a22bb6d593c9b790dCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d360b31f1a3666579422872aa7d1a751e20b76f9CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 060f827aa3dc47939ee306da715cd6700d129616CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 41dcae82bece9f106b4dff0ee777bba8d157c8a8CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cb3528ad8bb46fa6252f5d14ced7febddc18515dCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 72f9dd522f8d6c5a00be9695c7bb74631eb5069eCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8