Linux: Use After Free
CVE-2026-23450 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions f315277856caeafcd996c2611afc085ca2d53275, 1e4f873879e075bbd4eb1c644d6933303ac5eba4, f00fc26c8a06442b225a350fe000c0a11483e6a3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.46% chance of exploitation within 30 days, which is low compared with other CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Linux to f315277856caeafcd996c2611afc085ca2d53275 or 1e4f873879e075bbd4eb1c644d6933303ac5eba4 or f00fc26c8a06442b225a350fe000c0a11483e6a3 or cadf3da46c15523fba90d80c9955f536ee3b4023, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.78, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | ebfee3e153f67c8b38eb94a7062ee94aa6f92708 up to, but not including, f315277856caeafcd996c2611afc085ca2d53275; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, 1e4f873879e075bbd4eb1c644d6933303ac5eba4; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, f00fc26c8a06442b225a350fe000c0a11483e6a3; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, cadf3da46c15523fba90d80c9955f536ee3b4023; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, 1fab5ece76fb42a761178dcd0ebcbf578377b0dd; 8270d9c21041470f58348248b9d9dcf3bf79592e up to, but not including, 6d5e4538364b9ceb1ac2941a4deb86650afb3538; 5.15.174 up to, but not including, 5.15.203; and 1 more ranges | f315277856caeafcd996c2611afc085ca2d53275, 1e4f873879e075bbd4eb1c644d6933303ac5eba4, f00fc26c8a06442b225a350fe000c0a11483e6a3, cadf3da46c15523fba90d80c9955f536ee3b4023, fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2, 1fab5ece76fb42a761178dcd0ebcbf578377b0dd |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 5.15.174 up to, but not including, 5.15.203; 5.18 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.20; 6.19 up to, but not including, 6.19.10; 7.0 | 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
- git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
- git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
- git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
- git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
- git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
- git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
- 8.8 High severity
Spotted an error? Tell us.