Security readout for executives and security teams
Plain-English summary
CVE-2026-23098 is a Linux kernel NET/ROM networking flaw where the same packet buffer can be freed twice. Kernel memory corruption issues can threaten system stability and security, and the CVSS score is high. The source bundle does not show active exploitation.
Executive priority
Treat as high priority for Linux fleets, especially specialized networking hosts. There is no source-backed active exploitation claim, but unauthenticated adjacent-network reachability and potential full CIA impact justify timely patch validation.
Technical view
The flaw is a double-free in nr_route_frame(). old_skb is freed before checking whether nr_neigh->ax25 is NULL; if NULL, the caller can free old_skb again. The CVSS v3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with score 8.8.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with NET/ROM networking code enabled or available. The CVSS vector limits attack origin to adjacent network, with no privileges or user interaction required. Distribution backports may affect practical exposure.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector indicates low attack complexity from an adjacent network, but the sources do not provide exploit details, prerequisites beyond NET/ROM context, or real-world abuse reports.
Researcher notes
Evidence is limited to the CVE description, CVSS, affected version data, and Linux stable commit references. The affected version list appears source-derived but should be interpreted through distribution advisories because kernel vendors often backport fixes without changing upstream version numbers.
Mitigation direction
- Apply kernel updates that include the referenced stable fixes.
- Check Linux distribution advisories for backported package versions.
- Prioritize systems where NET/ROM support is enabled or loaded.
- If NET/ROM is unnecessary, review vendor-supported hardening options.
- Track CVE-2026-23098 until vendor guidance confirms remediation.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Confirm whether NET/ROM support is built, loadable, or active.
- Map installed kernels against vendor advisories and stable commits.
- Verify patched kernels are booted, not only installed.
- Document any systems awaiting maintenance windows.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 25aab6bfc31017a7e52035b99aef5c2b6bde8ffb
- Linux stable commit 6e0110ea90313b7c0558a0b77038274a6821caf8
- Linux stable commit 7c48fdf2d1349bb54815b56fb012b9d577707708
- Linux stable commit bd8955337e3764f912f49b360e176d8aaecf7016
- Linux stable commit 94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8c
- Linux stable commit 9f5fa78d9980fe75a69835521627ab7943cb3d67
- Linux stable commit ba1096c315283ee3292765f6aea4cca15816c4f7
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23098 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffbCVE reference, Linux
- https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8CVE reference, Linux
- https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708CVE reference, Linux
- https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016CVE reference, Linux
- https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8cCVE reference, Linux
- https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67CVE reference, Linux
- https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.