CVE-2026-98555 - Vulnerability Details

- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

Description

In the Linux kernel, the following vulnerability has been resolved:

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()
fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks
the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),
and double-frees skb when llc_conn_state_process() drops its reference.

In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is
leaked if llc_mac_hdr_init() returns an error.

Free nskb in all three error paths.

Published: 2026-10-18

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s LLC implementation causes a use‑after‑free and double‑free when llc_mac_hdr_init() fails. The wrong socket buffer is freed, a newly allocated buffer is leaked, and a read occurs from freed memory, allowing an attacker to corrupt kernel memory or leak data that should remain private.

Affected Systems

All Linux kernels that do not include the error‑path fix for llc_mac_hdr_init(), as introduced by commit 060f827aa3dc and its successors. Because no explicit version range is listed, any kernel lacking this commit is potentially vulnerable.

Risk and Exploitability

The CVSS score is 7.5 and the EPSS score is below 1 %. The flaw is not listed in CISA’s KEV catalog. Exploitation would require inducing a failure in llc_mac_hdr_init(), either through a malformed LLC packet or by gaining local code execution. The vulnerability could lead to memory corruption, double‑free, or information disclosure, but no widespread exploitation has been documented. The likely attack vector is local or network‑based access to LLC traffic.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fec0fe6838a7f45175667701fb51abb23a6ffb1e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b859ba18b5a1067f71db5618c6a4a70d55fa308b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8b855b645841b5a04e20339a22bb6d593c9b790d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d360b31f1a3666579422872aa7d1a751e20b76f9
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 060f827aa3dc47939ee306da715cd6700d129616
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 41dcae82bece9f106b4dff0ee777bba8d157c8a8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cb3528ad8bb46fa6252f5d14ced7febddc18515d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 72f9dd522f8d6c5a00be9695c7bb74631eb5069e

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fec0fe6838a7f45175667701fb51abb23a6ffb1e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b859ba18b5a1067f71db5618c6a4a70d55fa308b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8b855b645841b5a04e20339a22bb6d593c9b790d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d360b31f1a3666579422872aa7d1a751e20b76f9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,060f827aa3dc47939ee306da715cd6700d129616)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,41dcae82bece9f106b4dff0ee777bba8d157c8a8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cb3528ad8bb46fa6252f5d14ced7febddc18515d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,72f9dd522f8d6c5a00be9695c7bb74631eb5069e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes commit 060f827aa3dc or a newer kernel version that contains the llc_mac_hdr_init() error‑path fix
If LLC support is not required, disable CONFIG_LLC in the kernel configuration to eliminate the vulnerable code path
Configure firewall or netfilter rules to block LLC protocol traffic until the kernel patch is available as a temporary network‑level mitigation

Generated by OpenCVE AI on October 24, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0031.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98555.mbox
https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616
https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8
https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e
https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d
https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b
https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d
https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9
https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e
https://nvd.nist.gov/vuln/detail/CVE-2026-98555
https://www.cve.org/CVERecord?id=CVE-2026-98555

History

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 20 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401 CWE-415 CWE-416

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98555.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98555 https://www.cve.org/CVERecord?id=CVE-2026-98555
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 19 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401 CWE-415 CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.
Title		llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616 https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8 https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9 https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:22.631Z

Updated: 2026-10-24T14:09:24.593Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98555

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:07.610

Modified: 2026-10-24T14:16:47.463

Link: CVE-2026-98555

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98555 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T15:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object