Linux: Use After Free
CVE-2026-53275 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea, 1354271c89d0e5fbf8b3d94097ff0216695209c7, 53baa63a4183291574483f89583dbef13677a2c4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea or 1354271c89d0e5fbf8b3d94097ff0216695209c7 or 53baa63a4183291574483f89583dbef13677a2c4 or 2a613bf497029d555a7428406aa8cdb84a503cea, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.210 or 6.1.176 or 6.6.143 or 6.12.94, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 1354271c89d0e5fbf8b3d94097ff0216695209c7; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 53baa63a4183291574483f89583dbef13677a2c4; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 2a613bf497029d555a7428406aa8cdb84a503cea; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, b2eb8886200b907fc71806869620609f0f4cacb0; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 4203806f700bb44ea0b05d484d9d40044b47fb04; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 087dbacf897c020f438f780f0a4a8aa73b6d7c5a; 97300b5fdfe28c6edae926926f9467a27cf5889c up to, but not including, 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40; and 1 more ranges | dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea, 1354271c89d0e5fbf8b3d94097ff0216695209c7, 53baa63a4183291574483f89583dbef13677a2c4, 2a613bf497029d555a7428406aa8cdb84a503cea, b2eb8886200b907fc71806869620609f0f4cacb0, 4203806f700bb44ea0b05d484d9d40044b47fb04 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 2.6.15 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.1 | 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK> [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a
- git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7
- git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea
- git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04
- git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4
- git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40
- git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0
Other references
Recent Use After Free vulnerabilities
- 7.5 High severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.5 High severity
- 8.2 High severity
Spotted an error? Tell us.