CVE-2026-52981: Linux Kernel neigh_xmit SKB Memory Leak Denial of Service

Technical summary

CVE-2026-52981 is a use-after-free and resource management defect in the Linux kernel's neighbor subsystem. The `neigh_xmit()` function is designed to assume full ownership of the socket buffer (SKB) passed to it, meaning it should either transmit the buffer or release its memory. However, a code path exists where the function returns -EAFNOSUPPORT when no valid neighbor table is found (for example, NEIGH_ND_TABLE when IPv6 is disabled), bypassing the internal `out_kfree_skb` error handling path. This allows the SKB to leak without being freed or queued for transmission. The issue affects callers—notably the MPLS subsystem—that rely on `neigh_xmit()` to manage SKB lifecycle. The kernel patch removes the unhandled return path and ensures the function always assumes and properly manages SKB ownership.

Business impact

This vulnerability can lead to denial of service through memory exhaustion. An attacker or malfunctioning application that repeatedly triggers the uninitialized neighbor table condition can cause the kernel to accumulate unreleased memory buffers. Over time, this degrades system performance, exhausts available memory, and ultimately causes the system to become unresponsive or crash. For cloud providers, container platforms, and organizations running Linux systems handling high-throughput network operations, the cumulative effect of SKB leaks can significantly impact availability.

Affected systems

The vulnerability affects the Linux kernel across distributions and versions prior to the patch release. Any system running a vulnerable kernel version that uses IPv6 neighbor discovery or MPLS routing is potentially at risk, particularly systems where IPv6 may be disabled or misconfigured. The exact affected kernel version range should be verified against your distribution's security advisory, as the vulnerability manifests through kernel subsystem interactions rather than userspace applications.

Exploitability

This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code is known at this time. However, exploitation does not require network-based attacks or elevated privileges. An unprivileged local process that can trigger neighbor table lookups for disabled protocol families can induce the leak. The attack surface includes any network interface configuration change, protocol binding attempt, or routing operation that causes `neigh_xmit()` to be called with an uninitialized table. Exploitation requires no user interaction and can be performed through normal network operations.

Remediation

Apply the kernel patch that resolves the SKB ownership issue in `neigh_xmit()`. The fix ensures the function always takes responsibility for freeing or transmitting the SKB, eliminating the code path that previously bypassed cleanup. Verify the patched kernel version with your Linux distribution vendor and test in a non-production environment before deployment. For systems unable to patch immediately, monitor memory usage closely and review neighbor table initialization configurations to minimize triggering conditions.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Canonical, SUSE, etc.) for the patched kernel version addressing CVE-2026-52981. The upstream Linux kernel fix is available; coordinate with your vendor for backport availability and testing timelines. Apply patches to production systems following your change management process, typically requiring a reboot. Validate neighbor discovery functionality post-patch, particularly for IPv6 and MPLS environments. Coordinate patching windows to minimize availability impact.

Detection guidance

Monitor kernel memory usage patterns and swap pressure. A gradual increase in kernel memory consumption without corresponding user-space memory growth may indicate SKB leaks. Use kernel debugging tools (kmemleak, if enabled) to identify persistent memory objects. Network monitoring should track neighbor table state and protocol binding attempts. System logs may show out-of-memory (OOM) killer invocations under sustained leak conditions. Implement memory usage baselines and alert on sustained deviations above normal thresholds.

Why prioritize this

Although not yet widely exploited, this vulnerability carries a CVSS score of 7.5 (HIGH) due to its high attack complexity and availability impact. The lack of complexity requirements, absence of privilege escalation, and denial-of-service potential make this a priority remediation target. Systems under high network load or those with unstable IPv6/MPLS configurations face elevated risk. Organizations should prioritize patching based on workload criticality and network subsystem exposure.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-exploitable availability attack requiring no authentication or user interaction. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates the vulnerability is remotely triggerable with low complexity and directly impacts system availability (denial of service). The lack of confidentiality and integrity impacts reflects that this is purely a resource exhaustion issue. The score appropriately weights the severity for production infrastructure reliant on kernel stability.

Frequently asked questions