Linux: Use After Free
CVE-2026-53025 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 0597908256173da5256ef8e6db17ccc8d5c40ee3, e4d07fd4e30024a4a15094ef2c404197667c857e, 3abf97a03f4abce1dc3639eea2fcd4bd747b3308 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 0597908256173da5256ef8e6db17ccc8d5c40ee3 or e4d07fd4e30024a4a15094ef2c404197667c857e or 3abf97a03f4abce1dc3639eea2fcd4bd747b3308 or e72ffe59e48a74a8d9220f5ca1d03f2194d882f0, whichever matches your release line, or a later version.
- Update Linux Kernel to 7.0.10 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, 0597908256173da5256ef8e6db17ccc8d5c40ee3; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, e4d07fd4e30024a4a15094ef2c404197667c857e; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, 3abf97a03f4abce1dc3639eea2fcd4bd747b3308; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, e72ffe59e48a74a8d9220f5ca1d03f2194d882f0; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, ef2d97c15b19b3489de01695bce478601e236c3e; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 up to, but not including, 983cc2c7efbce04ecbf6328448d895044dd6ab31; 4.9 | 0597908256173da5256ef8e6db17ccc8d5c40ee3, e4d07fd4e30024a4a15094ef2c404197667c857e, 3abf97a03f4abce1dc3639eea2fcd4bd747b3308, e72ffe59e48a74a8d9220f5ca1d03f2194d882f0, ef2d97c15b19b3489de01695bce478601e236c3e, 983cc2c7efbce04ecbf6328448d895044dd6ab31 |
| Linux | Linux Kernel | 4.9 up to, but not including, 7.0.10 | 7.0.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory. To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Use After Free vulnerabilities
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 8.8 High severity
- 8.8 High severity
- 9.6 Critical severity
Spotted an error? Tell us.