In the Linux kernel, the following vulnerability has been resolved:

net/x25: Fix potential double free of skb

When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:

x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again

This would free the same skb twice. Looking at x25_backlog_rcv:

net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 3f5e3005984645bf5bd129c6b13149879580b1fb
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < f782dd382203b2a8c4552a628431b7de65a19a7b
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 524371398d8463ea7e101fce2cbf3915645d1730
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < fa1dbc93530b34fab0da9862426fe9c918c74dc0
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c87dd137c0dad07cc55f98181ff380b0c23d2878
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < d10a26aa4d072320530e6968ef945c8c575edf61
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
5.10.253 unaffected ≤ 5.10.*
5.15.203 unaffected ≤ 5.15.*
6.1.168 unaffected ≤ 6.1.*
6.6.134 unaffected ≤ 6.6.*
6.12.81 unaffected ≤ 6.12.*
6.18.22 unaffected ≤ 6.18.*
6.19.12 unaffected ≤ 6.19.*
7.0 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-6243-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1 cve-icon cve-icon
https://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb cve-icon cve-icon
https://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730 cve-icon cve-icon
https://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9 cve-icon cve-icon
https://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878 cve-icon cve-icon
https://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61 cve-icon cve-icon
https://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b cve-icon cve-icon
https://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0 cve-icon cve-icon
History

Fri, 01 May 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receives the return value 1 and takes the else branch at line 278, setting queued=0 and returning 0 | v x25_process_rx_frame returns queued=0 | v x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again This would free the same skb twice. Looking at x25_backlog_rcv: net/x25/x25_in.c:x25_backlog_rcv() { ... queued = x25_process_rx_frame(sk, skb); ... if (!queued) kfree_skb(skb); }
Title net/x25: Fix potential double free of skb
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-01T14:15:17.597Z

Reserved: 2026-05-01T14:12:55.974Z

Link: CVE-2026-43011

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-01T15:16:44.993

Modified: 2026-05-01T15:24:14.893

Link: CVE-2026-43011

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T18:00:09Z

Weaknesses

No weakness.