CVE-2026-43011

CRITICAL EPSS 39.9%
Published May 1, 20261mo ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published May 1, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receives the return value 1 and takes the else branch at line 278, setting queued=0 and returning 0 | v x25_process_rx_frame returns queued=0 | v x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again This would free the same skb twice. Looking at x25_backlog_rcv: net/x25/x25_in.c:x25_backlog_rcv() { ... queued = x25_process_rx_frame(sk, skb); ... if (!queued) kfree_skb(skb); }

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
39.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-415

Affected Products 18

VendorProductVersionRange
linuxlinux_kernel*≥2.6.12.1  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.168
linuxlinux_kernel*≥6.2  –  <6.6.134
linuxlinux_kernel*≥6.7  –  <6.12.81
linuxlinux_kernel*≥6.13  –  <6.18.22
linuxlinux_kernel*≥6.19  –  <6.19.12
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0
    Patch