Linux: Use After Free
CVE-2026-23340 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 5bb27ad54d12de67e457d7d251198e361bef835e, 7594467c49bfc2f4644dee0415ac2290db11fa0d, dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 5bb27ad54d12de67e457d7d251198e361bef835e or 7594467c49bfc2f4644dee0415ac2290db11fa0d or dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750 or 5bc4e69306ed7ae02232eb4c0b23ed621a26d504, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.77, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, 5bb27ad54d12de67e457d7d251198e361bef835e; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, 7594467c49bfc2f4644dee0415ac2290db11fa0d; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, 5bc4e69306ed7ae02232eb4c0b23ed621a26d504; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, 8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, c69df4e0524f8de8e176ba389acd83e85f5f49d0; 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 up to, but not including, 7f083faf59d14c04e01ec05a7507f036c965acf8; 4.16 | 5bb27ad54d12de67e457d7d251198e361bef835e, 7594467c49bfc2f4644dee0415ac2290db11fa0d, dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750, 5bc4e69306ed7ae02232eb4c0b23ed621a26d504, 8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb, c69df4e0524f8de8e176ba389acd83e85f5f49d0 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 4.16.1 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.77; 6.13 up to, but not including, 6.18.17; 6.19 up to, but not including, 6.19.7; 4.16; 7.0 | 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/5bb27ad54d12de67e457d7d251198e361bef835e
- git.kernel.org/stable/c/5bc4e69306ed7ae02232eb4c0b23ed621a26d504
- git.kernel.org/stable/c/7594467c49bfc2f4644dee0415ac2290db11fa0d
- git.kernel.org/stable/c/7f083faf59d14c04e01ec05a7507f036c965acf8
- git.kernel.org/stable/c/8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb
- git.kernel.org/stable/c/c69df4e0524f8de8e176ba389acd83e85f5f49d0
- git.kernel.org/stable/c/dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.