CVE-2026-53175

Katalog CVE

CVSS 9.8 · Critical EPSS 0,31%

Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

14 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free
CWE-825: Expired Pointer Dereference

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1 patch
• https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9 patch
• https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e patch
• https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9 patch
• https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4 patch
• https://access.redhat.com/security/cve/CVE-2026-53175 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2492840 issue tracking · advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53175.json advisory pihak ketiga