Live › vulnerability › CVE-2026-98555
Go to dashboardIn the Linux kernel's LLC (802.2) networking code, an error path frees the wrong socket buffer, leaving a use-after-free and a double free, and in other paths a buffer is leaked. The sources describe memory corruption in the kernel, and the attacker outcome beyond that is not stated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the llc (802.2 LLC) code path present and reachable. The sources do not say which configurations or traffic trigger the error path, so unknown whether typical servers or only specialised network setups are exposed.
No product ranges from the sources yet.
uname -r and compare the running kernel with the fixed stable release listed by your distribution for CVE-2026-98555lsmod | grep llc; unknown whether that is sufficient to be exposedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference.
In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error.
Free nskb in all three error paths.
This page as .md · .json · in your agent: get_signal("CVE-2026-98555")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.