Vulnerability in Linux Kernel Networking Component Affects Multiple Releases

CVE-2026-43481

What is CVE-2026-43481?

A vulnerability has been identified in the Linux kernel's networking subsystem related to the handling of Netlink messages. Specifically, in functions that manage reply messages, there is an improper resource management issue where the same socket buffer (skb) may be freed multiple times under different error conditions. This occurs after the genlmsg_reply() function call fails, leading to potential use-after-free scenarios. The resolution involves ensuring that errors from genlmsg_reply() are returned directly and that resources are only freed in predefined failure paths, thus mitigating risks associated with erroneous memory management.

References