High severity7.8NVD Advisory· Published May 13, 2026· Updated Jun 26, 2026

CVE-2026-43481

Description

In the Linux kernel, the following vulnerability has been resolved:

net-shapers: don't free reply skb after genlmsg_reply()

genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path.

net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice.

Return the genlmsg_reply() error directly and keep free_msg only for pre-reply failures.

Affected products

Linux/Kernel5 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.13,<6.18.19
- cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
- (no CPE)
osv-coords14 versions
pkg:linux/kernel pkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0
>= 6.13.0, < 6.18.19+ 13 more
- (no CPE)range: >= 6.13.0, < 6.18.19
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1.160000.2.19
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

CVE-2026-43481

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions