CVE-2026-43011: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43011 Overview

CVE-2026-43011 is a double free vulnerability in the Linux kernel's X.25 networking subsystem. The flaw resides in x25_queue_rx_frame() within net/x25/x25_in.c, where a failed alloc_skb() call frees the socket buffer (skb) and returns an error. The error path propagates back through x25_state3_machine() and x25_process_rx_frame() to x25_backlog_rcv(), which then calls kfree_skb(skb) on the same buffer. Exploitation can lead to kernel memory corruption and potential remote code execution over the network.

Critical Impact
A network-reachable attacker can trigger double-free conditions in kernel memory, enabling kernel-level code execution, privilege escalation, or denial of service on Linux systems with X.25 networking enabled.

Affected Products

Linux Kernel (multiple stable branches, per upstream commits)
Distributions shipping the X.25 protocol stack (net/x25 subsystem)
Systems with the CONFIG_X25 kernel option enabled

Discovery Timeline

2026-05-01 - CVE-2026-43011 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-43011

Vulnerability Analysis

The vulnerability is a classic double free in the Linux kernel X.25 receive path. When x25_queue_rx_frame() attempts to allocate a new socket buffer via alloc_skb() and the allocation fails, the function calls kfree_skb(skb) directly on the input buffer at line 48 and returns 1 to indicate an error.

This return value flows up the call chain. In x25_state3_machine() at line 278, the non-zero return triggers the else branch, which sets queued = 0 and returns 0. The caller x25_process_rx_frame() propagates queued = 0 back to x25_backlog_rcv(). At line 452, x25_backlog_rcv() checks if (!queued) and invokes kfree_skb(skb) a second time on the already-freed buffer.

Double-free conditions in kernel allocators can corrupt the slab freelist. Attackers commonly abuse this primitive to overlap freed objects with attacker-controlled allocations, achieving arbitrary kernel write or control-flow hijack.

Root Cause

The root cause is inconsistent ownership semantics between x25_queue_rx_frame() and x25_backlog_rcv(). The lower function frees the skb on the allocation failure path while still returning an error code that the upper function interprets as "not queued," prompting a second free. Neither function clears or transfers the pointer to signal that the buffer has already been released.

Attack Vector

An unauthenticated remote attacker can deliver crafted X.25 frames to a vulnerable host. By inducing memory pressure or specific allocation failures during frame processing, the attacker triggers the error path in x25_queue_rx_frame(). No user interaction or prior authentication is required. The X.25 stack processes received frames at the network layer, allowing exploitation across any interface bound to an X.25 link.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commit messages referenced below; see the Kernel Git Commit fa1dbc9 for the canonical fix.

Detection Methods for CVE-2026-43011

Indicators of Compromise

Unexpected kernel oops or panic messages referencing x25_backlog_rcv, x25_process_rx_frame, or kfree_skb in dmesg or /var/log/kern.log.
SLUB/SLAB debug warnings such as double free detected or Object already free tied to skbuff_head_cache.
Unusual X.25 traffic patterns on hosts that do not normally process X.25 frames.

Detection Strategies

Audit running kernels against the fixed commit hashes (fa1dbc9, 143d4fa, 3f5e300, 5243713, 5d0aa03, c87dd13, d10a26a, f782dd3) to confirm patch presence.
Enable CONFIG_SLUB_DEBUG and CONFIG_DEBUG_LIST in test environments to catch slab freelist corruption originating from the X.25 path.
Monitor kernel crash telemetry for repeated faults in net/x25 symbols, which may indicate exploitation attempts.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG:, WARNING:, and general protection fault entries containing X.25 symbols.
Track loaded kernel modules with lsmod | grep x25 across the fleet; flag hosts where the module is loaded without business justification.
Correlate network telemetry with kernel events to identify hosts receiving X.25 (AF_X25) traffic from unexpected sources.

How to Mitigate CVE-2026-43011

Immediate Actions Required

Apply vendor-supplied kernel updates that incorporate the upstream net/x25 double-free fix as soon as they become available.
Disable the X.25 kernel module on systems that do not require it by blacklisting x25 in /etc/modprobe.d/.
Restrict network exposure of any host that must run X.25, limiting access to trusted segments only.

Patch Information

The fix is committed across multiple stable Linux kernel branches. Reference commits include Kernel Git Commit 143d4fa, Kernel Git Commit 3f5e300, Kernel Git Commit 5243713, Kernel Git Commit 5d0aa03, Kernel Git Commit c87dd13, Kernel Git Commit d10a26a, Kernel Git Commit f782dd3, and Kernel Git Commit fa1dbc9. The fix removes the duplicate kfree_skb() from the error path in x25_queue_rx_frame() so that ownership is consistent with the caller in x25_backlog_rcv().

Workarounds

Blacklist the X.25 module to prevent it from loading at boot until patches are deployed.
Use iptables or nftables to drop frames destined for AF_X25 sockets where the kernel cannot be patched immediately.
Apply network segmentation to ensure only trusted peers can reach hosts that require X.25 connectivity.

bash

# Blacklist the x25 module to disable the vulnerable subsystem
echo "blacklist x25" | sudo tee /etc/modprobe.d/disable-x25.conf
sudo rmmod x25 2>/dev/null || true

# Verify the module is no longer loaded
lsmod | grep x25