CVE-2026-43481

⚠️ high

Summary

In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice. Return the genlmsg_reply() err

Description

In the Linux kernel, the following vulnerability has been resolved:

net-shapers: don't free reply skb after genlmsg_reply()

genlmsg_reply() hands the reply skb to netlink, and
netlink_unicast() consumes it on all return paths, whether the
skb is queued successfully or freed on an error path.

net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()
currently jump to free_msg after genlmsg_reply() fails and call
nlmsg_free(msg), which can hit the same skb twice.

Return the genlmsg_reply() error directly and keep free_msg
only for pre-reply failures.

CVSS Score

7.8

High

EPSS Score

0.1

Exploit Probability

Published Date

2026-05-13

First Seen: 2026-05-21

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 365,312 vulnerabilities in our database.

#115,044

Above average severity

Severity Percentile

Last Modified 2026-06-26

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
linux	linux_kernel	Affected	> 6.13 < 6.18.19
linux	linux_kernel	Affected	> 6.19 < 6.19.9
linux	linux_kernel	Affected	v7.0

🔗 References 3

https://git.kernel.org/stable/c/57885276cc16a2e2b762...

Patch

https://git.kernel.org/stable/c/83f7b54242d0abbfce35...

Patch

https://git.kernel.org/stable/c/8738dcc844fff7d0157e...

Patch

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-98164	🔶 medium	5.5	0.2	In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address s...	2026-09-29
CVE-2026-98163	⚠️ high	7.0	0.1	In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero re...	2026-09-26
CVE-2026-98049	🔶 medium	5.5	0.2	In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpx...	2026-09-25
CVE-2026-98050	⚠️ high	7.5	0.2	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ptp: Fix napi_gro_receive() call fr...	2026-09-25
CVE-2026-98051	🔶 medium	5.5	0.2	In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same s...	2026-09-25
CVE-2026-98052	⚠️ high	7.8	0.1	In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last before writing each d...	2026-09-25

These CVEs affect the same products