GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43481 (GCVE-0-2026-43481)

Vulnerability from cvelistv5 – Published: 2026-05-13 15:08 – Updated: 2026-08-05 12:28
VLAI
Title
net-shapers: don't free reply skb after genlmsg_reply()
Summary
In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice. Return the genlmsg_reply() error directly and keep free_msg only for pre-reply failures.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb , < 8738dcc844fff7d0157ee775230e95df3b1884d7 (git)
Affected: 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb , < 83f7b54242d0abbfce35a55c01322f50962ed3ee (git)
Affected: 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb , < 57885276cc16a2e2b76282c808a4e84cbecb3aae (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/shaper/shaper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8738dcc844fff7d0157ee775230e95df3b1884d7",
              "status": "affected",
              "version": "4b623f9f0f59652ea71fcb27d60b4c3b65126dbb",
              "versionType": "git"
            },
            {
              "lessThan": "83f7b54242d0abbfce35a55c01322f50962ed3ee",
              "status": "affected",
              "version": "4b623f9f0f59652ea71fcb27d60b4c3b65126dbb",
              "versionType": "git"
            },
            {
              "lessThan": "57885276cc16a2e2b76282c808a4e84cbecb3aae",
              "status": "affected",
              "version": "4b623f9f0f59652ea71fcb27d60b4c3b65126dbb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/shaper/shaper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet-shapers: don\u0027t free reply skb after genlmsg_reply()\n\ngenlmsg_reply() hands the reply skb to netlink, and\nnetlink_unicast() consumes it on all return paths, whether the\nskb is queued successfully or freed on an error path.\n\nnet_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()\ncurrently jump to free_msg after genlmsg_reply() fails and call\nnlmsg_free(msg), which can hit the same skb twice.\n\nReturn the genlmsg_reply() error directly and keep free_msg\nonly for pre-reply failures."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by local userspace through AF_NETLINK/NETLINK_GENERIC requests to the net-shaper family, not by received network packets. A plausible cloud/server deployment with a shaper-capable netdev such as MANA or iavf exposes this local control path.\nAC:L - The attacker can directly send the vulnerable GET or CAP_GET request and can make genlmsg_reply() fail by controlling the destination netlink socket state, such as filling its receive queue or closing it. No uncontrollable race or unusual memory-layout prerequisite is needed to trigger the double free.\nPR:L - The affected GET and CAP_GET operations do not have GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM; only the mutating operations require admin privileges. A basic unprivileged local user in a namespace containing a shaper-capable netdev can reach the vulnerable handlers.\nUI:N - Exploitation only requires the attacker to issue crafted netlink requests. No victim user action is required.\nS:U - The vulnerable component and impacted kernel resources are within the same local kernel security authority. This is standard local kernel compromise/DoS territory, not a VM, IOMMU, or other scope boundary escape.\nC:H - The bug double-frees a netlink reply sk_buff after netlink has already consumed it, creating kernel heap corruption/use-after-free potential. Under the required high-side scoring for memory corruption, this can be leveraged for high confidentiality impact.\nI:H - A double free of an skb is kernel heap memory corruption and can plausibly be shaped into write/control-flow primitives. Under the required high-side scoring for UAF-style corruption, integrity impact is high.\nA:H - Even without full exploitation, the double free can trigger allocator corruption, refcount faults, oopses, or panics. The attacker can repeatedly trigger the local netlink path, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:12.884Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8738dcc844fff7d0157ee775230e95df3b1884d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/83f7b54242d0abbfce35a55c01322f50962ed3ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/57885276cc16a2e2b76282c808a4e84cbecb3aae"
        }
      ],
      "title": "net-shapers: don\u0027t free reply skb after genlmsg_reply()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43481",
    "datePublished": "2026-05-13T15:08:29.116Z",
    "dateReserved": "2026-05-01T14:12:56.012Z",
    "dateUpdated": "2026-08-05T12:28:12.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43481",
      "date": "2026-09-16",
      "epss": "0.00119",
      "percentile": "0.02004"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43481\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-13T16:16:51.287\",\"lastModified\":\"2026-06-26T20:17:33.600\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet-shapers: don\u0027t free reply skb after genlmsg_reply()\\n\\ngenlmsg_reply() hands the reply skb to netlink, and\\nnetlink_unicast() consumes it on all return paths, whether the\\nskb is queued successfully or freed on an error path.\\n\\nnet_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()\\ncurrently jump to free_msg after genlmsg_reply() fails and call\\nnlmsg_free(msg), which can hit the same skb twice.\\n\\nReturn the genlmsg_reply() error directly and keep free_msg\\nonly for pre-reply failures.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/shaper/shaper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4b623f9f0f59652ea71fcb27d60b4c3b65126dbb\",\"lessThan\":\"8738dcc844fff7d0157ee775230e95df3b1884d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b623f9f0f59652ea71fcb27d60b4c3b65126dbb\",\"lessThan\":\"83f7b54242d0abbfce35a55c01322f50962ed3ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b623f9f0f59652ea71fcb27d60b4c3b65126dbb\",\"lessThan\":\"57885276cc16a2e2b76282c808a4e84cbecb3aae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/shaper/shaper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/57885276cc16a2e2b76282c808a4e84cbecb3aae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83f7b54242d0abbfce35a55c01322f50962ed3ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8738dcc844fff7d0157ee775230e95df3b1884d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:51:13+00:00",
      "cve": "CVE-2026-43481",
      "id": "CVE-2026-43481",
      "initial_release_date": "2026-05-13T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net-shapers: don\u0027t free reply skb after genlmsg_reply()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43481.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T17:03:34Z",
      "cve": "CVE-2026-43481",
      "id": "CVE-2026-43481",
      "initial_release_date": "2026-05-15T01:58:21Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "364",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43481",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43481.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.