Junglewise Threat Intelligence

CVE-2026-43011: Linux Kernel double free in net/x25 networking stack

CVE-2026-43011 · Severity: critical · CVSS 9.8 · Published 2026-05-01

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A critical vulnerability has been identified in the Linux kernel's X.25 networking protocol implementation, which is also used in certain Siemens industrial controllers. An attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by sending specially crafted network traffic. This could lead to a total loss of availability for the affected device and impact industrial operations.

Technical details

A double-free vulnerability (CWE-415) exists in the Linux kernel's X.25 protocol implementation within the net/x25/x25_in.c component. The issue occurs in x25_queue_rx_frame when an alloc_skb failure occurs; the function calls kfree_skb(skb) and returns an error. This error propagates through x25_state3_machine and x25_process_rx_frame back to x25_backlog_rcv, which incorrectly calls kfree_skb(skb) a second time because the 'queued' flag is set to 0. An attacker can trigger this condition remotely without authentication. Patches have been released for various stable kernel branches to remove the redundant kfree_skb call in the error path.

Affected products

  • Linux Linux Kernel 2.6.12-rc2 through 6.x
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-31: disclosed: Initial patch submission by Martin Schiller
  • 2026-04-11: patched: Commits merged into stable trees
  • 2026-05-01: advisory: CVE published

References

Related threats