Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to a system crash. The issue occurs when the system incorrectly attempts to release memory twice during certain network configuration tasks. While typically triggered by unusual user configurations, it represents a stability risk for affected Linux systems.
Technical details
A double-free vulnerability existed in net/core/netdev-genl.c within the netdev_nl_bind_rx_doit() function. The root cause was that genlmsg_reply() always consumes the socket buffer (skb), but the error handling path also attempted to free the same buffer using nlmsg_free(rsp) via a jump to the err_unbind label. An attacker or a misconfigured user process could potentially trigger this by providing a full receive buffer, leading to a kernel panic or memory corruption. The fix involves propagating the error directly to the user instead of jumping to the unbind error path that performs the redundant free.
Affected products
- Linux Linux 6.12, 6.18, 7.0, 7.1
Timeline
- 2026-06-05: disclosed: Initial patch authored by Jakub Kicinski
- 2026-06-25: advisory: NVD publication date