CVE-2026-43011

When the alloc_skb function cannot allocate memory in x25_queue_rx_frame, it frees the skb buffer by calling kfree_skb and returns an error code. The error code propagates through the call chain: x25_state3_machine, x25_process_rx_frame, until x25_backlog_rcv, which upon seeing the returned value queued=0 calls kfree_skb on the same buffer a second time. The result is a classic double free error causing corruption of the internal structures of the kernel memory allocator.

An attacker can cause kernel memory corruption, which in practice can result in privilege escalation, arbitrary code execution (RCE), or system failure (kernel panic / DoS).

Patches available in the Linux kernel stable repository should be applied, as indicated in the references (commits: 143d4fa68ae9, 3f5e3005984645, 524371398d84, 5d0aa038a90b, c87dd137c0da). It is recommended to update to a kernel version containing these fixes according to your system distribution.

Linux kernel versions containing vulnerable net/x25 subsystem code — exact versions indicated in the manufacturer's references (commits on stable kernel.org).