{"api_version":"1","generated_at":"2026-10-26T06:23:09+00:00","cve":"CVE-2026-98555","urls":{"html":"https://cve.report/CVE-2026-98555","api":"https://cve.report/api/cve/CVE-2026-98555.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98555","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98555"},"summary":{"title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:07","updated_at":"2026-10-24 14:16:47"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d","name":"https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e","name":"https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9","name":"https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e","name":"https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d","name":"https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8","name":"https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616","name":"https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b","name":"https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98555","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98555","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 fec0fe6838a7f45175667701fb51abb23a6ffb1e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 b859ba18b5a1067f71db5618c6a4a70d55fa308b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 8b855b645841b5a04e20339a22bb6d593c9b790d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 d360b31f1a3666579422872aa7d1a751e20b76f9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 060f827aa3dc47939ee306da715cd6700d129616 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 41dcae82bece9f106b4dff0ee777bba8d157c8a8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 cb3528ad8bb46fa6252f5d14ced7febddc18515d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 72f9dd522f8d6c5a00be9695c7bb74631eb5069e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fec0fe6838a7f45175667701fb51abb23a6ffb1e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b859ba18b5a1067f71db5618c6a4a70d55fa308b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8b855b645841b5a04e20339a22bb6d593c9b790d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d360b31f1a3666579422872aa7d1a751e20b76f9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"060f827aa3dc47939ee306da715cd6700d129616","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"41dcae82bece9f106b4dff0ee777bba8d157c8a8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"cb3528ad8bb46fa6252f5d14ced7febddc18515d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"72f9dd522f8d6c5a00be9695c7bb74631eb5069e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"2.6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - An adjacent peer can send an IEEE 802.2 LLC2 I-format response with F=1 and N(S)=vR; llc_rcv() through llc_conn_handler() and llc_conn_state_process() reaches the patched action in AWAIT or AWAIT_REJ. LLC2 frames require the same VLAN or Layer-2 domain.\nAC:H - The peer can establish via SABME and withhold replies until the poll timer creates AWAIT, but the UAF also requires llc_mac_hdr_init() to fail. On the relevant VLAN path this requires skb_cow_head() to return -ENOMEM or an admin-driven device/headroom change, which the Layer-2 peer cannot reliably control.\nPR:N - llc_rcv() and llc_conn_handler() perform no peer authentication; a peer can send SABME and the triggering I response without local credentials. CAP_NET_RAW in llc_ui_create() constrains the host process creating the listener, not the remote peer.\nUI:N - Once the LLC listener exists, llc_conn_handler() creates and drives the incoming socket before userspace accept(), while the peer supplies the SABME, waits for the timer state, and sends the triggering I response. No further victim action is required.\nS:U - llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() corrupts an skb owned by the host LLC stack, and all resulting effects remain within the same host-kernel security authority.\nC:H - The erroneous kfree_skb(skb) leaves pdu dangling, after which LLC_I_GET_NR(pdu) reads the freed object and llc_conn_state_process() continues using the same skb. Reuse of that slab object can expose attacker-influenced kernel memory.\nI:H - After the action frees the incoming skb, llc_conn_state_process() later calls kfree_skb(skb) again. Reallocation between these operations permits freed-object manipulation and allocator corruption capable of write or control-flow impact.\nA:H - The use-after-free culminates in a second kfree_skb() of the received frame in llc_conn_state_process(), which can cause a kernel oops, allocator failure, or panic."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:09:24.593Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e"},{"url":"https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b"},{"url":"https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d"},{"url":"https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9"},{"url":"https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616"},{"url":"https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8"},{"url":"https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d"},{"url":"https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e"}],"title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98555","datePublished":"2026-10-18T15:18:22.631Z","dateReserved":"2026-09-25T10:25:14.357Z","dateUpdated":"2026-10-24T14:09:24.593Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:07","lastModifiedDate":"2026-10-24 14:16:47","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98555","Ordinal":"1","Title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","CVE":"CVE-2026-98555","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98555","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.","Type":"Description","Title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure"}]}}}