CyberSecBulletin
CVE-2026-53225NVD status: Modified

Linux: Use of Uninitialized Resource

Published Updated By the CyberSecBulletin desk

CVE-2026-53225 is a critical-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 446e0ecd845abc394b24ae2030a883572bec9d16, 928dd94db23e8ba340f83d68f7f24d831b7a4426, d796cfd06074b579d265b28401306cadd30db945 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.58% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 446e0ecd845abc394b24ae2030a883572bec9d16 or 928dd94db23e8ba340f83d68f7f24d831b7a4426 or d796cfd06074b579d265b28401306cadd30db945 or 8ce96f1182644079249a24ac7e2ffc32e0301a46, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxdf21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, 446e0ecd845abc394b24ae2030a883572bec9d16; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, 928dd94db23e8ba340f83d68f7f24d831b7a4426; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, d796cfd06074b579d265b28401306cadd30db945; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, 8ce96f1182644079249a24ac7e2ffc32e0301a46; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, d6bd0bb7697ea8c0387b0d9d973453f479017b23; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, f76a8b323e28e0951f979dbef20a7496383c47df; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, 8e86817b8af4d552f3c6fe04ca52bb0c8c57411d; df21857714398acb8b24a8bb5a6d2286dd9c59ef up to, but not including, f8373d7090b745728de66308deeecc67e8d319ce; and 1 more ranges446e0ecd845abc394b24ae2030a883572bec9d16, 928dd94db23e8ba340f83d68f7f24d831b7a4426, d796cfd06074b579d265b28401306cadd30db945, 8ce96f1182644079249a24ac7e2ffc32e0301a46, d6bd0bb7697ea8c0387b0d9d973453f479017b23, f76a8b323e28e0951f979dbef20a7496383c47df
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel2.6.25 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

How developers prevent this class of flaw

  • Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Avoid race conditions (CWE-362) during initialization routines.

More Use of Uninitialized Resource vulnerabilities (CWE-908)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Resource vulnerabilities

Spotted an error? Tell us.