In the Linux kernel, the following vulnerability has been resolved:
net/x25: Fix potential double free of skb
When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:
x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again
This would free the same skb twice. Looking at x25_backlog_rcv:
net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-05-01 15:16
Updated : 2026-07-14 13:18
NVD link : CVE-2026-43011
Mitre link : CVE-2026-43011
CVE.ORG link : CVE-2026-43011
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-415
Double Free