9.8

CVE-2026-43011: linux Double Free

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2026-43011DEBIAN-CVE-2026-43011
Published 01-05-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-43011 is a critical (CVSS 9.8) Double Free vulnerability in linux. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.59%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 38 · Related 50
LSN-0121-1MGASA-2026-0108MGASA-2026-0110OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1

Timeline

  1. 01-05-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receives the return value 1 and takes the else branch at line 278, setting queued=0 and returning 0 | v x25_process_rx_frame returns queued=0 | v x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again This would free the same skb twice. Looking at x25_backlog_rcv: net/x25/x25_in.c:x25_backlog_rcv() { ... queued = x25_process_rx_frame(sk, skb); ... if (!queued) kfree_skb(skb); }

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.59%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

0.00 pp

From 0.59% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.59%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu157 products
  • linux< 3.13.0-214.265 | < 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3f5e3005984645bf5bd129c6b13149879580b1fb | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f782dd382203b2a8c4552a628431b7de65a19a7b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 524371398d8463ea7e101fce2cbf3915645d1730 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < fa1dbc93530b34fab0da9862426fe9c918c74dc0 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c87dd137c0dad07cc55f98181ff380b0c23d2878 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d10a26aa4d072320530e6968ef945c8c575edf61 | 2.6.12
  • linux_kernel≥ 2.6.12.1, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.168 | ≥ 6.2, < 6.6.134 | ≥ 6.7, < 6.12.81 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 2.6.12 | 2.6.12:rc2 | 2.6.12:rc3 | 2.6.12:rc4 | 2.6.12:rc5 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1

3 vendors · 160 products

References

53 links
Show all 53 references