01 Record

CVE-2026-43011

net/x25: Fix potential double free of skb

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

net/x25: Fix potential double free of skb

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.59% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 48.0% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-05-01 14:15Z6 MO AGO

Last updated

2026-10-19 19:06Z9 DAYS AGO

Reserved

2026-05-01

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-415Double FreeVariant
CWE-1341Multiple Releases of Same Resource or HandleBase

Data version

5.2

Document digest

84d2797742e84c9a628e55b64d7482f36aebf31c0e3ffd4c3f53fb7276fcaca2

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3f5e3005984645bf5bd129c6b13149879580b1fb, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f782dd382203b2a8c4552a628431b7de65a19a7b, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 524371398d8463ea7e101fce2cbf3915645d1730, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fa1dbc93530b34fab0da9862426fe9c918c74dc0, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c87dd137c0dad07cc55f98181ff380b0c23d2878, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d10a26aa4d072320530e6968ef945c8c575edf61, 2.6.12—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9
git.kernel.orghttps://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb
git.kernel.orghttps://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b
git.kernel.orghttps://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1
git.kernel.orghttps://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730
git.kernel.orghttps://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0
git.kernel.orghttps://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878
git.kernel.orghttps://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-457936.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.170-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.19.12-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.