CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit()
In the Linux kernel, the following vulnerability has been resolved:
netdev: fix double-free in netdevnlbindrxdoit()
Sashiko flags that genlmsgreply() always consumes the skb. The error path calls nlmsgfree(rsp) so we can't jump directly to it. Let's not unbind, just propagate the error to the user. This is the typical way of handling genlmsgreply() failures. They shouldn't happen unless user does something silly like calling the kernel with an already-full rcvbuf.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in resolved
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
An attacker needs local access and low privileges, as reflected by the CVSS vector. The affected error path is associated with a netlink reply failure; the description notes this should normally occur only when a caller does something such as invoking the kernel with an already-full receive buffer.
Is this likely to be reachable during normal operation?
The description characterizes genlmsg_reply() failures as atypical. It specifically identifies an already-full receive buffer as an example condition, so routine use is not indicated as the expected trigger.
What is the mitigation if an update cannot be applied immediately?
No supported configuration workaround is provided. Reducing untrusted local users' ability to invoke the relevant kernel netlink operation and avoiding intentionally exhausted netlink receive buffers may reduce exposure, but the described fix is the available remediation.