CVE-2026-98555: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In the Linux kernel, the following vulnerability has been resolved:
llc: fix skb UAF and leaks on llcmachdrinit() failure
In llcconnacresendixxxxset0orsendrr(), if llcmachdrinit() fails, kfreeskb(skb) is called instead of kfreeskb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLCIGETNR(pdu), and double-frees skb when llcconnstateprocess() drops its reference.
In llcsapactionsendxidr() and llcsapactionsendtestr(), nskb is leaked if llcmachdrinit() returns an error.
Free nskb in all three error paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Free the newly allocated nskb in all three llc_mac_hdr_init() error paths: in llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), call kfree_skb(nskb) instead of kfree_skb(skb), and ensure llc_sap_action_send_xid_r() and llc_sap_action_send_test_r() also free nskb when llc_mac_hdr_init() returns an error.