exploitDog

CVE-2026-23098

Опубликовано: 04 фев. 2026

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

netrom: fix double-free in nr_route_frame()

In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug.

Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 2.6.12.1 (включая) до 5.10.249 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.199 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 6.1.162 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.6.122 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.7 (включая) до 6.12.68 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.13 (включая) до 6.18.8 (исключая)

cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*

EPSS

Процентиль: 3%

0.00015

Низкий

7.8 High

CVSS3

Дефекты

CWE-415

Связанные уязвимости

CVE-2026-23098

CVSS3: 7.8

ubuntu

около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

CVE-2026-23098

redhat

около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

CVE-2026-23098

CVSS3: 7.8

debian

около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: n ...

GHSA-6qxm-gr5m-j478

CVSS3: 7.8

github

около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

EPSS

Процентиль: 3%

0.00015

Низкий

7.8 High

CVSS3

Дефекты

CWE-415