CVE-2026-43481 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice. Return the genlmsg_reply() error directly and keep free_msg only for pre-reply failures.
A vulnerability in the Linux kernel's net-shaper component can lead to a double free of a socket buffer (skb) after a generic netlink reply. This issue arises because the netlmsg_reply function transfers the skb to netlink, which then consumes it. If an error occurs, the skb can be freed, but netlink_unicast still attempts to process it, leading to a double free. The vulnerability affects the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/57885276cc16a2e2b76282c808a4e84cbecb3aae | kernel.org | Patch |
| https://git.kernel.org/stable/c/83f7b54242d0abbfce35a55c01322f50962ed3ee | kernel.org | Patch |
| https://git.kernel.org/stable/c/8738dcc844fff7d0157ee775230e95df3b1884d7 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.13, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 20, 2026 | CVE Modified | kernel.org |
| May 13, 2026 | New CVE Received | kernel.org |