CyberSecBulletin
CVE-2026-53009NVD status: Modified

Linux: Double Free

Published Updated By the CyberSecBulletin desk

CVE-2026-53009 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions aa30e355ee951e804cbc9ff3d5de429ec850eccb, 359906450690a1d70545220bde82ba74f3fd80f8, eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to aa30e355ee951e804cbc9ff3d5de429ec850eccb or 359906450690a1d70545220bde82ba74f3fd80f8 or eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db or 910e498613d5bf4cbe5f298c2613666c38679fab, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 7.0.10 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, aa30e355ee951e804cbc9ff3d5de429ec850eccb; d76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, 359906450690a1d70545220bde82ba74f3fd80f8; d76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db; d76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, 910e498613d5bf4cbe5f298c2613666c38679fab; d76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, 4c08fc2119ef0281cfa2cee007acf0a251be55f2; d76a60ba7afb89523c88cf2ed3a044ce4180289e up to, but not including, 1a303baa715e6b78d6a406aaf335f87ff35acfcd; 4.17aa30e355ee951e804cbc9ff3d5de429ec850eccb, 359906450690a1d70545220bde82ba74f3fd80f8, eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db, 910e498613d5bf4cbe5f298c2613666c38679fab, 4c08fc2119ef0281cfa2cee007acf0a251be55f2, 1a303baa715e6b78d6a406aaf335f87ff35acfcd
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
LinuxLinux Kernel4.17 up to, but not including, 7.0.107.0.10
Red HatEnterprise Linux7.0; 8.0; 9.0; 10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighCNA

Official description

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Double Free

The product calls free() twice on the same memory address.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Use a static analysis tool to find double free instances.

More Double Free vulnerabilities (CWE-415)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Double Free vulnerabilities

Spotted an error? Tell us.