Memory Leak in Linux Kernel Networking Stack

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: neigh: let neigh_xmit take skb ownership neigh_xmit always releases the skb, except when no neighbour table is found. But even the first added user of neigh_xmit (mpls) relied on neigh_xmit to release the skb (or queue it for tx). sashiko reported: If neigh_xmit() is called with an uninitialized neighbor table (for example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT and bypasses its internal out_kfree_skb error path. Because the return value of neigh_xmit() is ignored here, does this leak the SKB? Assume full ownership and remove the last code path that doesn't xmit or free skb.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52981

EUVD

EUVD-2026-38849

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 4.1 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel function neigh_xmit, which is responsible for transmitting network packets (skb). Normally, neigh_xmit takes ownership of the skb and releases it after transmission. However, if neigh_xmit is called with an uninitialized neighbor table (such as when IPv6 is disabled and NEIGH_ND_TABLE is not set), it returns an error (-EAFNOSUPPORT) and bypasses the usual skb release path. Because the return value of neigh_xmit is ignored by its caller, this can lead to a memory leak where the skb is not freed.

Impact Analysis

The impact of this vulnerability is a potential memory leak in the Linux kernel networking stack. When the skb is not properly freed due to the error condition, it can lead to increased memory usage and possibly degrade system performance or stability over time. In environments with high network traffic or where IPv6 is disabled, this could cause resource exhaustion or system crashes.

Hi! I’m here to help you understand CVE-2026-52981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70