In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In… (CVE-2026-98555)

The vulnerability in the Linux kernel's LLC module involves improper handling of socket buffers during error conditions in llc_mac_hdr_init(). Specifically, if llc_mac_hdr_init() fails, the code incorrectly frees the original skb instead of the newly allocated nskb, resulting in a memory leak of nskb, use-after-free reads from the freed skb, and double-free of skb when references are dropped later. Additionally, nskb is leaked in two other functions (llc_sap_action_send_xid_r() and llc_sap_action_send_test_r()) if llc_mac_hdr_init() returns an error. The fix involves freeing nskb properly in all error paths to prevent leaks and use-after-free issues.

This vulnerability can lead to memory corruption issues such as use-after-free and double-free, which may cause system instability or crashes. While no direct exploit in the wild is known, these conditions could potentially be leveraged for denial of service or other attacks depending on the kernel usage context.

A fix has been applied to the Linux kernel to properly free the newly allocated socket buffers (nskb) in all error paths related to llc_mac_hdr_init() failures. Users should update to the patched kernel versions once available. No additional mitigation steps are indicated.