{"id":"CVE-2026-98555","kind":"vulnerability","aliases":["CVE-2026-98555"],"related":[],"title":"Linux kernel LLC: use-after-free and memory leaks on MAC header failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.","summary":"In the Linux kernel's LLC (802.2) networking code, an error path frees the wrong socket buffer, leaving a use-after-free and a double free, and in other paths a buffer is leaked. The sources describe memory corruption in the kernel, and the attacker outcome beyond that is not stated.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","networking","self-hosted"],"not_affected_if":["kernel-without-llc"],"how_to_check":"- Run `uname -r` and compare the running kernel with the fixed stable release listed by your distribution for CVE-2026-98555\n- Check whether the llc module is loaded with `lsmod | grep llc`; unknown whether that is sufficient to be exposed","fix":"- Install the kernel update from your distribution or the upstream stable branch that includes the llc skb fix for CVE-2026-98555\n- Reboot into the patched kernel\n- unknown for a specific fixed version, as the sources do not list one","status":"open","published_at":"2026-10-18T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:29+00:00","updated_at":"2026-10-25T05:23:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel update from your distribution or the upstream stable branch that includes the llc skb fix for CVE-2026-98555\n- Reboot into the patched kernel\n- unknown for a specific fixed version, as the sources do not list one","reach":"unknown","title":"Linux kernel LLC: use-after-free and memory leaks on MAC header failure","impact":"high","summary":"In the Linux kernel's LLC (802.2) networking code, an error path frees the wrong socket buffer, leaving a use-after-free and a double free, and in other paths a buffer is leaked. The sources describe memory corruption in the kernel, and the attacker outcome beyond that is not stated.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","networking"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption; code execution not stated by the sources","analyst_note":"Check the NVD and upstream kernel stable commit for the fixed kernel versions and whether an attacker can trigger the path remotely.","how_to_check":"- Run `uname -r` and compare the running kernel with the fixed stable release listed by your distribution for CVE-2026-98555\n- Check whether the llc module is loaded with `lsmod | grep llc`; unknown whether that is sufficient to be exposed","needs_analyst":true,"not_affected_if":["kernel-without-llc"],"who_is_affected":"Systems running a Linux kernel with the llc (802.2 LLC) code path present and reachable. The sources do not say which configurations or traffic trigger the error path, so unknown whether typical servers or only specialised network setups are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3488,"output_tokens":622,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98555':17A,20A '0':112C '802.2':35B 'ac':106C 'action':165C,172C 'alloc':136C 'attack':74B 'beyond':76B 'buffer':45B,61B 'call':126C 'code':37B 'conn':105C,156C 'corrupt':68B 'cve':15A,18A 'describ':66B 'doubl':54B,151C 'double-fre':150C 'drop':159C 'error':39B,186C,192C 'fail':121C 'failur':14A,102C 'fix':92C 'follow':86C 'free':7A,41B,51B,55B,152C,187C 'freed':141C 'get':146C 'hdr':100C,119C,182C 'header':13A 'host':28B 'infrastructur':21B 'init':101C,120C,183C 'instead':127C 'kernel':2A,24B,32B,71B,84C 'kfree':122C,129C 'leak':10A,63B,96C,133C,178C 'leav':46B 'linux':1A,23B,31B,83C 'linux-kernel':22B 'llc':3A,34B,91C,98C,104C,117C,144C,155C,163C,170C,180C 'mac':12A,99C,118C,181C 'memori':9A,67B 'network':25B,36B 'newli':135C 'nr':147C 'nskb':131C,137C,176C,188C 'outcom':75B 'path':40B,59B,193C 'pdu':148C 'process':158C 'r':168C,175C 'read':138C 'refer':161C 'resend':107C 'resolv':90C 'return':184C 'rr':115C 'sap':164C,171C 'self':27B 'self-host':26B 'send':114C,166C,173C 'set':111C 'skb':93C,123C,124C,130C,142C,153C 'socket':44B 'sourc':65B 'state':80B,157C 'test':174C 'three':191C 'uaf':94C 'use':5A,49B 'use-after-fre':4A,48B 'via':143C 'vulner':87C 'wrong':43B 'x':110C 'xid':167C 'xxx':109C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the llc (802.2 LLC) code path present and reachable. The sources do not say which configurations or traffic trigger the error path, so unknown whether typical servers or only specialised network setups are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98555","severity":null,"published_at":"2026-10-18T16:17:07+00:00","modified_at":"2026-10-19T10:19:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}