Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23098

In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c7f59d2f21603439e057d87b66e7255a40bbaf4252d02357bca53ae0ed8297a4
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/netrom/nr_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.249","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.199","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.162","versionType":"semver"},{"les…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netrom/nr_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25aab6bfc31017a7e52035b99aef5c2b6bde8ffb","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6e0110ea90313b7c0558a0b77038274a6821caf8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7c48fdf2d1349bb54815b56fb012b9d577707708","status":"affected","version":"1da177e4c3f41524e886b7f1…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/netrom/nr_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.249","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.199","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.162","versionType":"semver"},{"les…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netrom/nr_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25aab6bfc31017a7e52035b99aef5c2b6bde8ffb","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6e0110ea90313b7c0558a0b77038274a6821caf8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7c48fdf2d1349bb54815b56fb012b9d577707708","status":"affected","version":"1da177e4c3f41524e886b7f1…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/metrics/0/cvssV3_1

Source references

7 source assertions
{"url":"https://git.kernel.org/stable/c/25aab6bfc31017a7e52035b99aef5c2b6bde8ffb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/6e0110ea90313b7c0558a0b77038274a6821caf8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/7c48fdf2d1349bb54815b56fb012b9d577707708"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/94d1a8bd08af1f4cc345c5c29f5db1ea72b8bb8c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/9f5fa78d9980fe75a69835521627ab7943cb3d67"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/ba1096c315283ee3292765f6aea4cca15816c4f7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/bd8955337e3764f912f49b360e176d8aaecf7016"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bf2b11e7b6ea6856388cd16d6802cdc522e9996b8c2c8ceb9bfccb710850fd7b · sha256:04e955dff33f3bf6… · /containers/cna/references/3

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer