CVE-2026-43481: net-shapers: don't free reply skb after genlmsg_reply()
In the Linux kernel, the following vulnerability has been resolved:
net-shapers: don't free reply skb after genlmsgreply()
genlmsgreply() hands the reply skb to netlink, and netlinkunicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path.
netshapernlgetdoit() and netshapernlcapgetdoit() currently jump to freemsg after genlmsgreply() fails and call nlmsgfree(msg), which can hit the same skb twice.
Return the genlmsgreply() error directly and keep freemsg only for pre-reply failures.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43481?
CVE-2026-43481 has been assigned a severity level that necessitates attention due to potential risks associated with the Linux kernel.
How do I fix CVE-2026-43481?
To fix CVE-2026-43481, update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-43481?
CVE-2026-43481 affects systems running specific versions of the Linux kernel that utilize netlink for message handling.
What type of vulnerability is CVE-2026-43481?
CVE-2026-43481 is a memory management vulnerability in the Linux kernel related to the handling of reply socket buffers.
Can CVE-2026-43481 lead to system exploitation?
Yes, CVE-2026-43481 could potentially be exploited to cause memory corruption issues, leading to instability or unauthorized access.