CVE-2026-43011: Linux Kernel double free in net/x25 networking stack

CVE-2026-43011 · Severity: critical · CVSS 9.8 · Published 2026-05-01

A critical vulnerability has been identified in the Linux kernel's X.25 networking protocol implementation, which is also used in certain Siemens industrial controllers. An attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by sending specially crafted network traffic. This could lead to a total loss of availability for the affected device and impact industrial operations.

Technologies: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens.

Quick answers

Is CVE-2026-43011 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43011 being exploited in the wild.
How severe is CVE-2026-43011?
Critical severity, with a CVSS score of 9.8, published 1 May 2026.
Which products and versions are affected?
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-43011?
A patch was published on 2026-04-11: Commits merged into stable trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43011 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-43011?
Check whether you run Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability (CWE-415) exists in the Linux kernel's X.25 protocol implementation within the net/x25/x25_in.c component. The issue occurs in x25_queue_rx_frame when an alloc_skb failure occurs; the function calls kfree_skb(skb) and returns an error. This error propagates through x25_state3_machine and x25_process_rx_frame back to x25_backlog_rcv, which incorrectly calls kfree_skb(skb) a second time because the 'queued' flag is set to 0. An attacker can trigger this condition remotely without authentication. Patches have been released for various stable kernel branches to remove the redundant kfree_skb call in the error path.

Affected products

  • Linux Linux Kernel 2.6.12-rc2 through 6.x
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-31: disclosed: Initial patch submission by Martin Schiller
  • 2026-04-11: patched: Commits merged into stable trees
  • 2026-05-01: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.