CyberSecBulletin
CVE-2026-23336NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-23336 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 82a35356b5c1f75fe6a8a561db44e8d0e49da8f9, b2e9626a9d16b9bbbd06498c9e73c93be354dc7a, eeea8da43ab86ac0a6b9cec225eec91564346940 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 82a35356b5c1f75fe6a8a561db44e8d0e49da8f9 or b2e9626a9d16b9bbbd06498c9e73c93be354dc7a or eeea8da43ab86ac0a6b9cec225eec91564346940 or fa18639deab4a3662d543200c5bfc29bf4e23173, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, 82a35356b5c1f75fe6a8a561db44e8d0e49da8f9; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, b2e9626a9d16b9bbbd06498c9e73c93be354dc7a; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, eeea8da43ab86ac0a6b9cec225eec91564346940; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, fa18639deab4a3662d543200c5bfc29bf4e23173; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, 57e39fe8da573435fa35975f414f4dc17d9f8449; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, 584279ad9ff1e8e7c5494b9fce286201f7d1f9e2; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5; 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 up to, but not including, 767d23ade706d5fa51c36168e92a9c5533c351a1; and 1 more ranges82a35356b5c1f75fe6a8a561db44e8d0e49da8f9, b2e9626a9d16b9bbbd06498c9e73c93be354dc7a, eeea8da43ab86ac0a6b9cec225eec91564346940, fa18639deab4a3662d543200c5bfc29bf4e23173, 57e39fe8da573435fa35975f414f4dc17d9f8449, 584279ad9ff1e8e7c5494b9fce286201f7d1f9e2
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel2.6.31.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.77; 6.13 up to, but not including, 6.18.17; 6.19 up to, but not including, 6.19.7; 2.6.31; and 1 more ranges5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK> The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.