A fault exists in the Linux kernel’s LLC implementation that is triggered when llc_mac_hdr_init() fails. The error path frees the wrong socket buffer (skb), leading to a use‑after‑free, a subsequent double‑free, and a memory leak of the newly allocated skb. These kernel memory operations can corrupt memory and expose data that should remain private to the kernel space.

Linux kernels that have not incorporated the error‑path fix for llc_mac_hdr_init(), as embodied in commit 060f827aa3dc and subsequent references. The affected vendor is Linux; no precise version range is enumerated in the advisory, so any kernel missing the patch is considered vulnerable.

The CVSS score is not disclosed, the EPSS value is unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger the bug via a malformed LLC packet or local code execution. The flaw could allow kernel memory corruption, information disclosure, or double‑free exploits, but there is no evidence of widespread exploitation to date. The likely attack vector is local or network-based access to LLC traffic.