CVE-2026-23098

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23098
In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffb Patch
https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8 Patch
https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708 Patch
https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8c Patch
https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67 Patch
https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7 Patch
https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

03 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 8.8

18 Mar 2026, 20:09

Type Values Removed Values Added
CWE CWE-415
References () https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffb - () https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffb - Patch
References () https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8 - () https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8 - Patch
References () https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708 - () https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708 - Patch
References () https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8c - () https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8c - Patch
References () https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67 - () https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67 - Patch
References () https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7 - () https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7 - Patch
References () https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016 - () https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netrom: soluciona doble liberación en nr_route_frame() En nr_route_frame(), old_skb es liberado inmediatamente sin comprobar si el puntero nr_neigh->ax25 es NULL. Por lo tanto, si nr_neigh->ax25 es NULL, la función llamadora liberará old_skb de nuevo, causando un error de doble liberación. Por lo tanto, para evitar esto, necesitamos modificarlo para comprobar si nr_neigh->ax25 es NULL antes de liberar old_skb.
CPE cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffb -
  • () https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8 -
  • () https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708 -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-04-03 14:16

NVD link : CVE-2026-23098

Mitre link : CVE-2026-23098

CVE.ORG link : CVE-2026-23098

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free