{"id":"CVE-2026-98555","state":"PUBLISHED","title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.","publishedAt":"2026-10-18T15:18:22.631Z","updatedAt":"2026-10-24T14:09:24.593Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"fec0fe6838a7f45175667701fb51abb23a6ffb1e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"b859ba18b5a1067f71db5618c6a4a70d55fa308b","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"8b855b645841b5a04e20339a22bb6d593c9b790d","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"d360b31f1a3666579422872aa7d1a751e20b76f9","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"060f827aa3dc47939ee306da715cd6700d129616","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"41dcae82bece9f106b4dff0ee777bba8d157c8a8","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"cb3528ad8bb46fa6252f5d14ced7febddc18515d","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"72f9dd522f8d6c5a00be9695c7bb74631eb5069e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"]}],"references":["https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e","https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b","https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d","https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9","https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616","https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8","https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d","https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98555.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98555","state":"PUBLISHED","datePublished":"2026-10-18T15:18:22.631Z","dateUpdated":"2026-10-24T14:09:24.593Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.357Z"},"containers":{"cna":{"title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"fec0fe6838a7f45175667701fb51abb23a6ffb1e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"b859ba18b5a1067f71db5618c6a4a70d55fa308b","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"8b855b645841b5a04e20339a22bb6d593c9b790d","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"d360b31f1a3666579422872aa7d1a751e20b76f9","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"060f827aa3dc47939ee306da715cd6700d129616","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"41dcae82bece9f106b4dff0ee777bba8d157c8a8","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"cb3528ad8bb46fa6252f5d14ced7febddc18515d","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"72f9dd522f8d6c5a00be9695c7bb74631eb5069e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/llc/llc_c_ac.c","net/llc/llc_s_ac.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e"},{"url":"https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b"},{"url":"https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d"},{"url":"https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9"},{"url":"https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616"},{"url":"https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8"},{"url":"https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d"},{"url":"https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - An adjacent peer can send an IEEE 802.2 LLC2 I-format response with F=1 and N(S)=vR; llc_rcv() through llc_conn_handler() and llc_conn_state_process() reaches the patched action in AWAIT or AWAIT_REJ. LLC2 frames require the same VLAN or Layer-2 domain.\nAC:H - The peer can establish via SABME and withhold replies until the poll timer creates AWAIT, but the UAF also requires llc_mac_hdr_init() to fail. On the relevant VLAN path this requires skb_cow_head() to return -ENOMEM or an admin-driven device/headroom change, which the Layer-2 peer cannot reliably control.\nPR:N - llc_rcv() and llc_conn_handler() perform no peer authentication; a peer can send SABME and the triggering I response without local credentials. CAP_NET_RAW in llc_ui_create() constrains the host process creating the listener, not the remote peer.\nUI:N - Once the LLC listener exists, llc_conn_handler() creates and drives the incoming socket before userspace accept(), while the peer supplies the SABME, waits for the timer state, and sends the triggering I response. No further victim action is required.\nS:U - llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() corrupts an skb owned by the host LLC stack, and all resulting effects remain within the same host-kernel security authority.\nC:H - The erroneous kfree_skb(skb) leaves pdu dangling, after which LLC_I_GET_NR(pdu) reads the freed object and llc_conn_state_process() continues using the same skb. Reuse of that slab object can expose attacker-influenced kernel memory.\nI:H - After the action frees the incoming skb, llc_conn_state_process() later calls kfree_skb(skb) again. Reallocation between these operations permits freed-object manipulation and allocator corruption capable of write or control-flow impact.\nA:H - The use-after-free culminates in a second kfree_skb() of the received frame in llc_conn_state_process(), which can cause a kernel oops, allocator failure, or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-24T14:09:24.593Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}