CyberSecBulletin
CVE-2026-53011NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-53011 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions a8fc396519ef4f081bc545e88f61241728bb78d7, 3471874578160a28c171a607fa069f24062634b8, 7256996e1ef553716817f3bfd077c2f3b48b582f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to a8fc396519ef4f081bc545e88f61241728bb78d7 or 3471874578160a28c171a607fa069f24062634b8 or 7256996e1ef553716817f3bfd077c2f3b48b582f or eee072fe16c646190d33ae69c9983d8de1562bf8, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.141, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, a8fc396519ef4f081bc545e88f61241728bb78d7; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, 3471874578160a28c171a607fa069f24062634b8; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, 7256996e1ef553716817f3bfd077c2f3b48b582f; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, eee072fe16c646190d33ae69c9983d8de1562bf8; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, 1bd286fa3e21200133478ed523cc6a2788baf38a; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, b73235da5dde77ed1264f9767b62c28c9d71fd78; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, 0e62171df8ed4804d00db088f17eed06468233fa; a3d43c0d56f1b94e74963a2fbadfb70126d92213 up to, but not including, 105425b1969c5affe532713cfac1c0b320d7ac2b; and 1 more rangesa8fc396519ef4f081bc545e88f61241728bb78d7, 3471874578160a28c171a607fa069f24062634b8, 7256996e1ef553716817f3bfd077c2f3b48b582f, eee072fe16c646190d33ae69c9983d8de1562bf8, 1bd286fa3e21200133478ed523cc6a2788baf38a, b73235da5dde77ed1264f9767b62c28c9d71fd78
LinuxLinux Kernel5.2 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.141; 6.7 up to, but not including, 6.12.91; 6.13 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.105.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->end_time = end_time' and rcu_assign_pointer(q->current_entry, next) are use-after-free. Fix this by selecting 'next' from the new oper schedule immediately after switch_schedules(), and using its pre-calculated end_time. setup_first_end_time() sets the first entry's end_time to base_time + interval when the schedule is installed, so the value is already correct. The deleted 'end_time = sched_base_time(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated end_time with just base_time.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.