Strix
72.8K

CVE-2026-98555

HIGHCVSS 7.5/10EPSS 0.21%

Last modified

CVE-2026-98555 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.21%

10.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < fec0fe6838a7f45175667701fb51abb23a6ffb1e; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b859ba18b5a1067f71db5618c6a4a70d55fa308b; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8b855b645841b5a04e20339a22bb6d593c9b790d; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d360b31f1a3666579422872aa7d1a751e20b76f9; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 060f827aa3dc47939ee306da715cd6700d129616; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 41dcae82bece9f106b4dff0ee777bba8d157c8a8; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < cb3528ad8bb46fa6252f5d14ced7febddc18515d; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 72f9dd522f8d6c5a00be9695c7bb74631eb5069e
LinuxLinux2.6.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98555?
In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.
How severe is CVE-2026-98555?
CVE-2026-98555 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98555?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98555?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST