CVE-2026-43481

7.8 Élevée

Publiée le 13/05/2026 à 18:16 · Modifiée le 26/06/2026 à 22:17 · Analysée par le NVD · Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Description

In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice. Return the genlmsg_reply() error directly and keep free_msg only for pre-reply failures.

Traduire en français

Produits concernés

Linux
Linux linux kernel

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	416baaa9-dc9f-4396-8d5f-8c081fb06d67	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Références

https://git.kernel.org/stable/c/57885276cc16a2e2b76282c808a4e84cbecb3aae Patch
https://git.kernel.org/stable/c/83f7b54242d0abbfce35a55c01322f50962ed3ee Patch
https://git.kernel.org/stable/c/8738dcc844fff7d0157ee775230e95df3b1884d7 Patch

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories