Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in NET/ROM packet routing can free the same network buffer twice under a specific neighbor-state condition. The resulting memory corruption could crash a system or potentially compromise data and system integrity. Risk is highest where affected NET/ROM code is reachable from an adjacent network.
Executive priority
Treat as a high-priority kernel update for systems using NET/ROM or exposed to adjacent untrusted peers. For other Linux systems, first validate whether the subsystem is enabled and whether vendor packages contain the fix. No active exploitation is established by the supplied evidence.
Technical view
In nr_route_frame(), old_skb is freed before checking whether nr_neigh->ax25 is NULL. When it is NULL, the caller can free old_skb again, causing a double-free. The cited kernel changes prevent this by checking the pointer before freeing the buffer.
Likely exposure
Exposure is most likely on Linux systems using affected kernel code with NET/ROM networking available to adjacent peers. The bundle lists multiple affected versions but does not provide clear distribution package mappings. Confirm status against the running kernel build and its vendor backports.
Exploitation context
The CVSS 3.1 score is 8.8 with adjacent-network access, low complexity, no privileges, and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public working exploit.
Researcher notes
The vulnerable condition requires nr_neigh->ax25 to be NULL along the nr_route_frame() path, allowing caller-side reuse of the free operation. No CWE, proof of concept, exploitability demonstration, or distribution-specific fixed versions are supplied. The seven references appear to represent stable-branch fixes.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Check distribution security guidance for backported fixes and corrected package versions.
- Restrict adjacent access to NET/ROM networking where operationally feasible.
- Prioritize systems that actively use or expose NET/ROM functionality.
Validation and detection
- Inventory running kernel versions and distribution package revisions.
- Determine whether NET/ROM networking is enabled or operationally required.
- Verify the applicable stable commit or vendor backport is present.
- Confirm updated systems booted into the corrected kernel.
- Review kernel telemetry for crashes or memory-corruption indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23098 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffbCVE reference, Linux
- https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8CVE reference, Linux
- https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708CVE reference, Linux
- https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016CVE reference, Linux
- https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8cCVE reference, Linux
- https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67CVE reference, Linux
- https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.