IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-98555llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

Linux Linux Publicada: (hace 24 días)

Descripción

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Linux Linux 2.6.12
linux linux kernel 2.6.12 – < 5.10.271

Correcciones de Ubuntu

  • USN-8961-1 Linux kernel vulnerabilities Ubuntu 22.04, 20.04 · 03.11.2026 · linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure,...
  • USN-8963-1 Linux kernel (NVIDIA Tegra) vulnerabilities Ubuntu 22.04, 20.04 · 03.11.2026 · linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
  • USN-8959-1 Linux kernel vulnerabilities Ubuntu 26.04, 24.04 · 03.11.2026 · linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle
  • USN-8960-1 Linux kernel (OEM) vulnerabilities Ubuntu 26.04 · 03.11.2026 · linux-oem-7.0

Referencias y parches

CVE recientes del mismo producto — Ubuntu 20.04 LTS

7.7Alta
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

Sin puntuación
CVE-2026-98912

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5Alta
CVE-2026-98911

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…

Sin puntuación
CVE-2026-98909

net: cpsw_new: unregister devlink on port registration failure

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregis…

Sin puntuación
CVE-2026-98907

btrfs: protect sb_write_pointer() with invalidate lock

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLK…

Sin puntuación
CVE-2026-98902

md/raid5: let stripe batch bm_seq comparison wrap-safe

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.