{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98555", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:22.631Z", "dateUpdated": "2026-10-24T14:09:24.593Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:24.593Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - An adjacent peer can send an IEEE 802.2 LLC2 I-format response with F=1 and N(S)=vR; llc_rcv() through llc_conn_handler() and llc_conn_state_process() reaches the patched action in AWAIT or AWAIT_REJ. LLC2 frames require the same VLAN or Layer-2 domain.\nAC:H - The peer can establish via SABME and withhold replies until the poll timer creates AWAIT, but the UAF also requires llc_mac_hdr_init() to fail. On the relevant VLAN path this requires skb_cow_head() to return -ENOMEM or an admin-driven device/headroom change, which the Layer-2 peer cannot reliably control.\nPR:N - llc_rcv() and llc_conn_handler() perform no peer authentication; a peer can send SABME and the triggering I response without local credentials. CAP_NET_RAW in llc_ui_create() constrains the host process creating the listener, not the remote peer.\nUI:N - Once the LLC listener exists, llc_conn_handler() creates and drives the incoming socket before userspace accept(), while the peer supplies the SABME, waits for the timer state, and sends the triggering I response. No further victim action is required.\nS:U - llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() corrupts an skb owned by the host LLC stack, and all resulting effects remain within the same host-kernel security authority.\nC:H - The erroneous kfree_skb(skb) leaves pdu dangling, after which LLC_I_GET_NR(pdu) reads the freed object and llc_conn_state_process() continues using the same skb. Reuse of that slab object can expose attacker-influenced kernel memory.\nI:H - After the action frees the incoming skb, llc_conn_state_process() later calls kfree_skb(skb) again. Reallocation between these operations permits freed-object manipulation and allocator corruption capable of write or control-flow impact.\nA:H - The use-after-free culminates in a second kfree_skb() of the received frame in llc_conn_state_process(), which can cause a kernel oops, allocator failure, or panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/llc/llc_c_ac.c", "net/llc/llc_s_ac.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fec0fe6838a7f45175667701fb51abb23a6ffb1e", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b859ba18b5a1067f71db5618c6a4a70d55fa308b", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8b855b645841b5a04e20339a22bb6d593c9b790d", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d360b31f1a3666579422872aa7d1a751e20b76f9", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "060f827aa3dc47939ee306da715cd6700d129616", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "41dcae82bece9f106b4dff0ee777bba8d157c8a8", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cb3528ad8bb46fa6252f5d14ced7febddc18515d", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "72f9dd522f8d6c5a00be9695c7bb74631eb5069e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/llc/llc_c_ac.c", "net/llc/llc_s_ac.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.271" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e" }, { "url": "https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b" }, { "url": "https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d" }, { "url": "https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9" }, { "url": "https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616" }, { "url": "https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8" }, { "url": "https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d" }, { "url": "https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e" } ], "title": "llc: fix skb UAF and leaks on llc_mac_hdr_init() failure", "x_generator": { "engine": "bippy-1.2.0" } } } }