NetSight
IP …
high8.8

CVE-2026-23098

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately fre…

Impact

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12.1 before 5.10.249
from 5.11 before 5.15.199
from 5.16 before 6.1.162
from 6.2 before 6.6.122
from 6.7 before 6.12.68
from 6.13 before 6.18.8

Weakness classification

CWE-415

References