CVE-2026-98555 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
A use-after-free and memory leak in the Linux kernel LLC protocol allows local attackers to potentially execute code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98555?
CVE-2026-98555 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu), and double-frees skb when llc_conn_state_process() drops its reference.
In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is leaked if llc_mac_hdr_init() returns an error.
Free nskb in all three error paths.
Which versions are affected by CVE-2026-98555?
How do I fix CVE-2026-98555?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98555 being exploited?
There is no known exploitation of CVE-2026-98555 in the wild and no public exploit code.
Sources
Also known as AZL-109395, BELL-CVE-2026-98555, DEBIAN-CVE-2026-98555, GHSA-q422-9435-7hfq, UBUNTU-CVE-2026-98555.