---
id: CVE-2026-43011
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/x25: Fix potential double free of skb

  When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
  line 48 and returns 1 (error).
  This error propagates ba…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/x25: Fix potential double free of skb

  When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
  line 48 and returns 1 (error).
  This error propagates ba…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-415
  - CWE-1341
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.12.1, < 5.10.253'
  - 'linux_kernel >= 5.11, < 5.15.203'
  - 'linux_kernel >= 5.16, < 6.1.168'
  - 'linux_kernel >= 6.2, < 6.6.134'
  - 'linux_kernel >= 6.7, < 6.12.81'
  - 'linux_kernel >= 6.13, < 6.18.22'
  - 'linux_kernel >= 6.19, < 6.19.12'
  - linux_kernel = 2.6.12
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.12
published: '2026-05-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:23.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43011'
references:
  - url: 'https://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-082556.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43011.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-43011'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2464421'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-43011'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43011'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026050155-CVE-2026-43011-dc56@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00591
epssPercentile: 0.48059
ingestedAt: '2026-09-08T15:33:26.989Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:13:26.745898Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/x25: Fix potential double free of skb

When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:

x25_queue_rx_frame returns 1
    |
    v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
    |
    v
x25_process_rx_frame returns queued=0
    |
    v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again

This would free the same skb twice. Looking at x25_backlog_rcv:

net/x25/x25_in.c:x25_backlog_rcv() {
    ...
    queued = x25_process_rx_frame(sk, skb);
    ...
    if (!queued)
        kfree_skb(skb);
}

## Affected

- `linux_kernel >= 2.6.12.1, < 5.10.253`
- `linux_kernel >= 5.11, < 5.15.203`
- `linux_kernel >= 5.16, < 6.1.168`
- `linux_kernel >= 6.2, < 6.6.134`
- `linux_kernel >= 6.7, < 6.12.81`
- `linux_kernel >= 6.13, < 6.18.22`
- `linux_kernel >= 6.19, < 6.19.12`
- `linux_kernel = 2.6.12`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.12`

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43011.json)