Linux Kernel CVE-2026-98555

Exploitation requires the target to have the Linux LLC (IEEE 802.2) code path reachable and requires the attacker to be on the same Layer-2/adjacent network (AV:A) so that crafted LLC frames reach the affected handlers - llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), llc_sap_action_send_xid_r(), and llc_sap_action_send_test_r(). The trigger is the error path where llc_mac_hdr_init() fails; the specific condition that forces this failure is not described in the available sources, and reaching it reliably is non-trivial (reflected in AC:H). Limiting factors: no authentication is needed (PR:N) and no user interaction (UI:N), but exploitation is bounded to adjacent attackers, to systems where LLC is actually exercised (a legacy/rarely-used protocol), and to successfully steering execution down a low-frequency error branch - which substantially constrains real-world exploitability beyond the 7.5 base score.

This is a memory-safety flaw (use-after-free, double-free, and memory leak) in the Linux kernel's LLC (IEEE 802.2 Logical Link Control) subsystem, triggered on the error path when llc_mac_hdr_init() fails. The supplied CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes an adjacent-network, high-complexity, unauthenticated issue with high confidentiality/integrity/availability impact - consistent with a UAF that both reads freed memory (LLC_I_GET_NR(pdu)) and double-frees an skb. However, the real-world exploitation signals point much lower: EPSS is only 0.21% (11th percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference appears in the input. The vuln.today priority is 'this_week' (not act_now/emergency) and a vendor patch is available. The signals are therefore coherent rather than conflicting: a genuinely patch-worthy kernel memory-corruption bug, but with low probability of widespread opportunistic exploitation because it requires adjacent (same L2 segment) access, depends on forcing an error path (AC:H) that is not attacker-friendly to reach reliably, and affects a legacy, rarely-enabled protocol (LLC). Note the input Tags label this 'Information Disclosure', which only partially captures the flaw - the primary mechanism is UAF/double-free (memory corruption / DoS, with potential for more), and the freed-memory read is one component.

An attacker on the same Layer-2 segment sends crafted LLC (802.2) frames to a host with LLC processing active, timed or shaped so that llc_mac_hdr_init() fails inside one of the affected action handlers; the kernel then leaks or operates on a freed skb and double-frees it, corrupting kernel memory. In practice this most reliably yields a kernel crash (denial of service), with use-after-free offering a theoretical path to further impact. No public exploit or PoC is identified in the available sources, and exactly how to force llc_mac_hdr_init() to fail is not described in the input.