CVE-2026-52981: neigh: let neigh_xmit take skb ownership
Published Jun 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
neigh: let neighxmit take skb ownership
neighxmit always releases the skb, except when no neighbour table is found. But even the first added user of neighxmit (mpls) relied on neighxmit to release the skb (or queue it for tx).
sashiko reported: If neighxmit() is called with an uninitialized neighbor table (for example, NEIGHNDTABLE when IPv6 is disabled), it returns -EAFNOSUPPORT and bypasses its internal outkfreeskb error path. Because the return value of neighxmit() is ignored here, does this leak the SKB?
Assume full ownership and remove the last code path that doesn't xmit or free skb.
Affected Software
8 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.139.1-1<6.6.143.1-1
6.6.143.1-1
Linux Linux kernel>=4.1<6.1.175
Linux Linux kernel>=6.2<6.6.141
Linux Linux kernel>=6.7<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10
Linux Linux kernel=7.1-rc1
Remediation
Event History
Jun 24, 2026
CVE Published
via MITRE·04:28 PM
Data Sourced
via MITRE·04:28 PM
DescriptionSeverity
Data Sourced
via NVD·05:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 27, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeaknessAffected Software