CVE-2026-43481

A flaw was found in the Linux kernel's net-shapers component. An issue exists where the skb (socket buffer) is freed twice if genlmsg_reply() fails, leading to a double-free vulnerability. This can result in memory corruption or a denial of service (DoS) condition, potentially allowing a local attacker to impact system stability.

A double-free flaw in the Linux kernel net-shapers generic netlink handlers can occur when an error returned by genlmsg_reply() is followed by an explicit nlmsg_free() of the same reply skb, even though ownership has already been transferred to the netlink stack. A local attacker able to invoke the affected netlink get operations could trigger kernel memory corruption, most likely resulting in a denial of service. Privilege escalation would require additional, unproven control over skb reuse after the double free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.