Cloudanix VulnDB

CVE-2026-98555

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain network connections can cause crashes or wasted memory, so systems should be updated to the corrected version.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect skb reference handling in LLC connection and SAP action functions causes use-after-free reads, double-free, and memory leaks when llc_mac_hdr_init fails, allowing invalid memory access and resource exhaustion in the Linux kernel networking stack.

Why it matters to the business

Linux systems using LLC protocols may experience kernel crashes, denial of service, or memory leaks that degrade performance and availability, with added urgency due to the recent public disclosure requiring prompt patching across fleets.

How an attack unfolds

An attacker triggers specific LLC state machine transitions or SAP actions that invoke llc_mac_hdr_init under failure conditions, leading to the kernel operating on a freed skb, leaking newly allocated buffers, and performing a double-free when the reference count drops.

How to fix it

Apply the upstream fix that ensures nskb is freed in all three error paths instead of skb; rebuild and deploy the corrected Linux kernel across affected systems.

How to confirm the fix worked

Review the patched kernel source to confirm nskb release in the error paths of the three functions, then test LLC connection establishment under simulated llc_mac_hdr_init failure conditions.

Typical attack path

  1. Craft network traffic or local socket operations to reach llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr, llc_sap_action_send_xid_r, or llc_sap_action_send_test_r
  2. Force llc_mac_hdr_init to fail via resource exhaustion or malformed headers
  3. Trigger kfree_skb on the wrong buffer while the original skb is later accessed and freed again

How to detect it

Search kernel logs and crash dumps for LLC-related oops or warnings around skb handling; examine network traces for unusual LLC XID/TEST frames coinciding with memory pressure events.

What your security team should do

  • Prioritize kernel updates on systems exposing LLC interfaces within the next maintenance window
  • Monitor for upstream stable releases containing this LLC fix and schedule phased rollouts
  • Audit custom or older kernels for the presence of the vulnerable LLC state handling code

The record

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.

Affected packages

Ecosystem Package Introduced Fixed