CVE-2026-23098: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23098 Overview

CVE-2026-23098 is a double-free vulnerability in the Linux kernel's netrom (NET/ROM amateur radio protocol) subsystem. The flaw resides in the nr_route_frame() function, where old_skb is freed without first verifying that the nr_neigh->ax25 pointer is non-NULL. When nr_neigh->ax25 is NULL, the calling function frees old_skb a second time, producing memory corruption tracked as [CWE-415]. A local authenticated attacker can exploit the resulting corruption to compromise confidentiality, integrity, and availability on the affected host.

Critical Impact
A local attacker with low privileges can trigger kernel memory corruption through the netrom protocol path, leading to potential privilege escalation or denial of service.

Affected Products

Linux Kernel (mainline, from version 2.6.12 onward)
Linux Kernel 6.19 release candidates (rc1 through rc6)
Distributions shipping the unpatched netrom driver

Discovery Timeline

2026-02-04 - CVE-2026-23098 published to NVD
2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-23098

Vulnerability Analysis

The vulnerability exists in nr_route_frame(), a routing function in the kernel's NET/ROM implementation under net/netrom/. NET/ROM is a layer-3 protocol used over AX.25 amateur radio links. The function is responsible for forwarding socket buffers (skb) to a neighbor entry represented by nr_neigh.

In the defective code path, nr_route_frame() unconditionally frees the original socket buffer (old_skb) before checking whether the associated nr_neigh->ax25 pointer is valid. If the AX.25 neighbor pointer is NULL, the function returns an error to the caller. The caller, expecting ownership of the buffer on failure, then frees old_skb again. The second kfree_skb() operates on a buffer already released to the kernel slab allocator.

Root Cause

The root cause is incorrect ownership semantics around the socket buffer lifecycle. The fix requires moving the NULL check on nr_neigh->ax25 before the call that releases old_skb, ensuring the buffer is freed exactly once along every return path. This class of defect maps to [CWE-415] Double Free.

Attack Vector

Exploitation requires local access and low privileges. An attacker with the ability to send frames or trigger routing on a netrom interface can drive the code path that reaches nr_route_frame() with a neighbor whose ax25 pointer is NULL. The resulting double-free corrupts kernel heap metadata. Skilled attackers can convert heap corruption into arbitrary kernel memory writes and ultimately into privilege escalation. The user interaction requirement is none, and the scope is unchanged. Verified patch commits include 25aab6b, 6e0110e, 7c48fdf, 94d1a8b, 9f5fa78, ba1096c, and bd89553.

No verified public proof-of-concept code is available. See the upstream commits listed under Patch Information for technical details of the fix.

Detection Methods for CVE-2026-23098

Indicators of Compromise

Kernel oops or panic logs referencing nr_route_frame, kfree_skb, or slab allocator corruption messages such as SLUB: double free detected.
Unexpected loading or activity of the netrom and ax25 kernel modules on systems that do not legitimately use amateur radio networking.
Kernel crashes correlated with unprivileged users opening AF_NETROM sockets.

Detection Strategies

Monitor dmesg and /var/log/kern.log for double-free, use-after-free, or general protection fault entries originating in net/netrom/.
Audit running kernel versions against the patched commits to identify unpatched hosts at scale.
Use auditd rules to flag socket() syscalls with the AF_NETROM (family 6) argument from non-radio workloads.

Monitoring Recommendations

Centralize kernel logs and alert on slab allocator warnings and kernel BUG traces.
Track loaded kernel modules across the fleet and alert on the appearance of netrom or ax25 where unexpected.
Correlate kernel crash events with local user activity to surface potential exploitation attempts.

How to Mitigate CVE-2026-23098

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 25aab6b, 6e0110e, 7c48fdf, 94d1a8b, 9f5fa78, ba1096c, and bd89553, or upgrade to a distribution kernel that incorporates them.
Where netrom is not required, blacklist the netrom and ax25 modules to remove the attack surface entirely.
Restrict local shell access on multi-tenant systems until patched kernels are deployed.

Patch Information

The Linux kernel maintainers have published the fix across multiple stable trees. The corrected logic moves the nr_neigh->ax25 NULL check before the kfree_skb(old_skb) call so the buffer is released exactly once. Patches are available at Kernel Patch 25aab6b, Kernel Patch 6e0110e, Kernel Patch 7c48fdf, Kernel Patch 94d1a8b, Kernel Patch 9f5fa78, Kernel Patch ba1096c, and Kernel Patch bd89553.

Workarounds

Blacklist the vulnerable modules by adding install netrom /bin/true and install ax25 /bin/true to a file under /etc/modprobe.d/.
Unload the modules at runtime with rmmod netrom and rmmod ax25 when no active sockets exist.
Apply seccomp or AppArmor/SELinux policies that deny socket(AF_NETROM, ...) for untrusted users.

bash

# Configuration example: disable netrom and ax25 modules
echo 'install netrom /bin/true' | sudo tee /etc/modprobe.d/blacklist-netrom.conf
echo 'install ax25   /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-netrom.conf
sudo rmmod netrom 2>/dev/null
sudo rmmod ax25   2>/dev/null