CVE-2026-43481

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net-shapers component where the reply socket buffer (skb) is freed twice. The genlmsg reply() function transfers the reply skb to netlink, and netlink unicast() consumes it regardless of whether the skb is queued successfully or freed during an error path. However, the functions net shaper nl get doit() and net shaper nl cap get doit() jump to free msg after genlmsg reply() fails and call nlmsg free(msg), leading to a double free of the same skb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.