HIGH Introduced in 2.6.12
llc MacHdr UAF
CVE-2026-98555
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference. In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error. Free nskb in all three error paths.
02KernelScan AI Analysis
Risk summary
A local attacker with access to AF_LLC sockets (CAP_NET_RAW) can trigger a use-after-free and double-free in the LLC subsystem by causing llc_mac_hdr_init() to fail during connection or SAP operations. This allows kernel memory corruption leading to privilege escalation or denial of service. Systems with LLC enabled on LAN interfaces (e.g., for bridging/STP) may also be reachable via crafted link-local frames.
Vulnerability analysis
When llc_mac_hdr_init() fails to initialize a MAC header for a newly allocated socket buffer (nskb), three error paths incorrectly handle the failure: one frees the original skb instead of nskb (causing a leak of nskb, a use-after-free read from the freed skb, and a subsequent double-free when the connection state machine releases its reference), while the other two simply leak nskb. The fix corrects all three paths to free nskb on error. The vulnerability is reachable locally by any process that can create AF_LLC sockets (typically requiring CAP_NET_RAW, available in many container environments), and remotely on the local link by sending crafted LLC frames to interfaces with LLC enabled (common in bridging configurations).
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.12 | 5.10.271 | fec0fe6838a7 |
| 5.15 | 2.6.12 | 5.15.222 | b859ba18b5a1 |
| 6.1 | 2.6.12 | 6.1.189 | 8b855b645841 |
| 6.12 | 2.6.12 | 6.12.112 | 060f827aa3dc |
| 6.18 | 2.6.12 | 6.18.55 | 41dcae82bece |
| 6.6 | 2.6.12 | 6.6.158 | d360b31f1a36 |
| 7.2 | 2.6.12 | 7.2.9 | cb3528ad8bb4 |
| mainline | 2.6.12 | 7.3 | 72f9dd522f8d |
| cip/5.10 | 2.6.12 | 5.10.271-cip78 | fec0fe6838a7 |
| cip/6.1 | 2.6.12 | 6.1.189-cip61 | 8b855b645841 |
| cip/6.1-rt | 2.6.12 | 6.1.189-cip61-rt32 | 8b855b645841 |
| cip/6.12 | 2.6.12 | 6.12.112-cip33 | 060f827aa3dc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |