CVE-2026-98555
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
llc: corrige el uso tras liberación (UAF) de skb y las fugas de memoria ante un fallo de llc_mac_hdr_init()
En llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), si llc_mac_hdr_init() falla, se invoca kfree_skb(skb) en lugar de kfree_skb(nskb). Esto provoca una fuga de la nskb recién asignada, lee desde la skb ya liberada mediante LLC_I_GET_NR(pdu) y libera skb dos veces cuando llc_conn_state_process() descarta su referencia.
En llc_sap_action_send_xid_r() y llc_sap_action_send_test_r(), se produce una fuga de nskb si llc_mac_hdr_init() devuelve un error.
Leer descripción completaMostrar menos
Libera nskb en las tres rutas de error.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616
- https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8
- https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e
- https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d
- https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b
- https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d
- https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9
- https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98555",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "fec0fe6838a7f45175667701fb51abb23a6ffb1e",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "b859ba18b5a1067f71db5618c6a4a70d55fa308b",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "8b855b645841b5a04e20339a22bb6d593c9b790d",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "d360b31f1a3666579422872aa7d1a751e20b76f9",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "060f827aa3dc47939ee306da715cd6700d129616",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "41dcae82bece9f106b4dff0ee777bba8d157c8a8",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "cb3528ad8bb46fa6252f5d14ced7febddc18515d",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "72f9dd522f8d6c5a00be9695c7bb74631eb5069e",
"versionType": "git"
}
],
"programFiles": [
"net/llc/llc_c_ac.c",
"net/llc/llc_s_ac.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/llc/llc_c_ac.c",
"net/llc/llc_s_ac.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:07.610",
"references": [
{
"url": "https://git.kernel.org/stable/c/060f827aa3dc47939ee306da715cd6700d129616",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41dcae82bece9f106b4dff0ee777bba8d157c8a8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/72f9dd522f8d6c5a00be9695c7bb74631eb5069e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b855b645841b5a04e20339a22bb6d593c9b790d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b859ba18b5a1067f71db5618c6a4a70d55fa308b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb3528ad8bb46fa6252f5d14ced7febddc18515d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d360b31f1a3666579422872aa7d1a751e20b76f9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fec0fe6838a7f45175667701fb51abb23a6ffb1e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths."
}
],
"lastModified": "2026-10-19T10:19:11.930",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}