CyberSecBulletin
CVE-2026-53112NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-53112 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ae10d4a1ab6bcaa1336abb171908a9a365761d3e, fac1079e0fdec6df6d7562c21941587236dc3def, e40873820c9d245ce482faa7ad514ebdb3b8d23d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ae10d4a1ab6bcaa1336abb171908a9a365761d3e or fac1079e0fdec6df6d7562c21941587236dc3def or e40873820c9d245ce482faa7ad514ebdb3b8d23d or 008c456b76e9070979bc0e763897a5d3b0fdd4dc, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.141, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, ae10d4a1ab6bcaa1336abb171908a9a365761d3e; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, fac1079e0fdec6df6d7562c21941587236dc3def; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, e40873820c9d245ce482faa7ad514ebdb3b8d23d; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, 008c456b76e9070979bc0e763897a5d3b0fdd4dc; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, 7731b67bd59d1284d150cbe40a47e95a10613234; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, aa10a452e34810987fb9f4a047995b30003fb53f; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, 3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b; 0c8173385e549f95cd80c3fff5aab87b4f881d8d up to, but not including, 039cd522dc70151da13329a5e3ae19b1736f468a; and 1 more rangesae10d4a1ab6bcaa1336abb171908a9a365761d3e, fac1079e0fdec6df6d7562c21941587236dc3def, e40873820c9d245ce482faa7ad514ebdb3b8d23d, 008c456b76e9070979bc0e763897a5d3b0fdd4dc, 7731b67bd59d1284d150cbe40a47e95a10613234, aa10a452e34810987fb9f4a047995b30003fb53f
LinuxLinux Kernel2.6.38 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.141; 6.7 up to, but not including, 6.12.91; 6.13 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.105.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211_hw is deallocated. However, irq_prepare_bcn_tasklet may still be running or pending, leading to use-after-free when the freed ieee80211_hw is accessed in _rtl_pci_prepare_bcn_tasklet(). Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to ensure that irq_prepare_bcn_tasklet is properly terminated before the ieee80211_hw is released. The issue was identified through static analysis.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.