CyberSecBulletin
CVE-2026-53198NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-53198 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions b7063c7426ea5a4d15e01b60538718765392f49d, 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd, 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.45% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b7063c7426ea5a4d15e01b60538718765392f49d or 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd or 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 or 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1.176 or 6.6.143 or 6.12.94 or 6.18.36, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, b7063c7426ea5a4d15e01b60538718765392f49d; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, f580d27e8928828693df44ba2db0fffdbe11dfea; 5.15b7063c7426ea5a4d15e01b60538718765392f49d, 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd, 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147, 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d, 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694, f580d27e8928828693df44ba2db0fffdbe11dfea
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel5.15 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.16.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the worker frees the file_lock with locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never reaches release_async_work() -- the only site that unlinks the work from conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays matchable on async_requests with a live cancel_fn pointing at the freed file_lock, until connection teardown finally runs release_async_work(). smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs smb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free: BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (cancelled branch) ... cache file_lock_cache of size 192 Reproduced on mainline with KASAN by an authenticated SMB client. Skip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback cannot be fired a second time.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.