CVE-2026-43011: net/x25: Fix potential double free of skb
In the Linux kernel, the following vulnerability has been resolved:
net/x25: Fix potential double free of skb
When allocskb fails in x25queuerxframe it calls kfreeskb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain:
x25queuerxframe returns 1 | v x25state3machine receives the return value 1 and takes the else branch at line 278, setting queued=0 and returning 0 | v x25processrxframe returns queued=0 | v x25backlogrcv at line 452 sees queued=0 and calls kfreeskb(skb) again
This would free the same skb twice. Looking at x25backlogrcv:
net/x25/x25in.c:x25backlogrcv() { ... queued = x25processrxframe(sk, skb); ... if (!queued) kfreeskb(skb); }
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43011?
CVE-2026-43011 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43011?
To fix CVE-2026-43011, update your Linux kernel to the latest available version that includes the security patch.
What systems are affected by CVE-2026-43011?
The affected systems are those running the Linux kernel with the net/x25 subsystem.
What is the nature of the vulnerability in CVE-2026-43011?
CVE-2026-43011 is a potential double free vulnerability involving the skb structure in the networking subsystem.
Is there a known exploit for CVE-2026-43011?
As of now, there are no publicly known exploits specifically targeting CVE-2026-43011.