CVE-2026-98555None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instea…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference.
In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error.
Free nskb in all three error paths.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fec0fe6838a7f45175667701fb51abb23a6ffb1eLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b859ba18b5a1067f71db5618c6a4a70d55fa308bLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8b855b645841b5a04e20339a22bb6d593c9b790dLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d360b31f1a3666579422872aa7d1a751e20b76f9Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 060f827aa3dc47939ee306da715cd6700d129616Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 41dcae82bece9f106b4dff0ee777bba8d157c8a8Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cb3528ad8bb46fa6252f5d14ced7febddc18515dLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 72f9dd522f8d6c5a00be9695c7bb74631eb5069eLinux 2.6.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device