In the Linux kernel, the following vulnerability has been resolved:
net-shapers: don't free reply skb after genlmsg_reply()
genlmsg_reply() hands the reply skb to netlink, and
netlink_unicast() consumes it on all return paths, whether the
skb is queued successfully or freed on an error path.
net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()
currently jump to free_msg after genlmsg_reply() fails and call
nlmsg_free(msg), which can hit the same skb twice.
Return the genlmsg_reply() error directly and keep free_msg
only for pre-reply failures.
References
Configurations
Configuration 1 (hide)
|
History
26 Jun 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/57885276cc16a2e2b76282c808a4e84cbecb3aae - Patch | |
| References | () https://git.kernel.org/stable/c/83f7b54242d0abbfce35a55c01322f50962ed3ee - Patch | |
| References | () https://git.kernel.org/stable/c/8738dcc844fff7d0157ee775230e95df3b1884d7 - Patch |
20 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
13 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 16:16
Updated : 2026-06-26 20:17
NVD link : CVE-2026-43481
Mitre link : CVE-2026-43481
CVE.ORG link : CVE-2026-43481
JSON object : View
Products Affected
linux
- linux_kernel
CWE