CVE-2026-98555

In the Linux kernel, the following vulnerability has been resolved:

llc: fix skb UAF and leaks on llc mac hdr init() failure

In llc conn ac resend i xxx x set 0 or send rr(), if llc mac hdr init() fails, kfree skb(skb) is called instead of kfree skb(nskb). This leaks the newly allocated nskb, reads from the freed skb via LLC I GET NR(pdu), and double-frees skb when llc conn state process() drops its reference.

In llc sap action send xid r() and llc sap action send test r(), nskb is leaked if llc mac hdr init() returns an error.

Free nskb in all three error paths.