Linux: Use After Free
CVE-2026-53193 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 586b219a22b1032b28b8bd356b963276c5e5bf53, f46093dd22969037beb1fce2e043f3236be41c92, 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 586b219a22b1032b28b8bd356b963276c5e5bf53 or f46093dd22969037beb1fce2e043f3236be41c92 or 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f or da3039e91d1f835874ed6e9a33ea19ee80c2cb92, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.12.94 or 6.18.36 or 7.0.13, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 37745918e0e7575bc40f38da93a99b9fa6406224 up to, but not including, 586b219a22b1032b28b8bd356b963276c5e5bf53; 37745918e0e7575bc40f38da93a99b9fa6406224 up to, but not including, f46093dd22969037beb1fce2e043f3236be41c92; 37745918e0e7575bc40f38da93a99b9fa6406224 up to, but not including, 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f; 37745918e0e7575bc40f38da93a99b9fa6406224 up to, but not including, da3039e91d1f835874ed6e9a33ea19ee80c2cb92; 6.12 | 586b219a22b1032b28b8bd356b963276c5e5bf53, f46093dd22969037beb1fce2e043f3236be41c92, 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f, da3039e91d1f835874ed6e9a33ea19ee80c2cb92 |
| Linux | Linux Kernel | 6.12 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.1 | 6.12.94, 6.18.36, 7.0.13 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Use After Free vulnerabilities
- 7.5 High severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.5 High severity
- 8.2 High severity
Spotted an error? Tell us.