|
ELS
< Back

CVE-2026-53239

Updated on 25 Jun 2026

Severity

7.0 High severity

Details

CVSS score
7.0
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed.

Race:

CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 11 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 20.04 ELS
Affected packages:
kernel @ 5.10.0 (+9 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9.2 ESU Released
33 kernels
  • 5.14.0-284.1101.el9_2.tuxcare.7.els20
  • 5.14.0-284.1101.el9_2.tuxcare.7.els21
  • 5.14.0-284.1101.el9_2.tuxcare.7.els23
  • 5.14.0-284.1101.el9_2.tuxcare.7.els22
  • 5.14.0-284.1101.el9_2.tuxcare.7.els14
  • 5.14.0-284.1101.el9_2.tuxcare.7.els18
  • 5.14.0-284.1101.el9_2.tuxcare.7.els16
  • 5.14.0-284.1101.el9_2.tuxcare.7.els15
  • 5.14.0-284.1101.el9_2.tuxcare.7.els17
  • 5.14.0-284.1101.el9_2.tuxcare.7.els19
  • 5.14.0-284.1101.el9_2.tuxcare.7.els24
  • 5.14.0-284.1101.el9_2.tuxcare.7.els25
  • 5.14.0-284.1101.el9_2.tuxcare.7.els26
  • 5.14.0-284.1101.el9_2.tuxcare.7.els27
  • 5.14.0-284.1101.el9_2.tuxcare.7.els28
  • 5.14.0-284.1101.el9_2.tuxcare.7.els29
  • 5.14.0-284.1101.el9_2.tuxcare.7.els30
  • 5.14.0-284.1101.el9_2.tuxcare.7.els31
  • 5.14.0-284.1101.el9_2.tuxcare.7.els32
  • 5.14.0-284.1101.el9_2.tuxcare.7.els35
  • 5.14.0-284.1101.el9_2.tuxcare.7.els34
  • 5.14.0-284.1101.el9_2.tuxcare.11.els1
  • 5.14.0-284.1101.el9_2.tuxcare.11.els2
  • 5.14.0-284.1101.el9_2.tuxcare.11.els3
  • 5.14.0-284.1101.el9_2.tuxcare.11.els4
  • 5.14.0-284.1101.el9_2.tuxcare.11.els5
  • 5.14.0-284.1101.el9_2.tuxcare.11.els6
  • 5.14.0-284.1101.el9_2.tuxcare.11.els7
  • 5.14.0-284.1101.el9_2.tuxcare.11.els8
  • 5.14.0-284.1101.el9_2.tuxcare.11.els9
  • 5.14.0-284.1101.el9_2.tuxcare.11.els10
  • 5.14.0-284.1101.el9_2.tuxcare.11.els11
  • 5.14.0-284.1101.el9_2.tuxcare.11.els12
AlmaLinux 9.6 ESU Planned —
Amazon Linux 2023 Planned —
Debian 11 Planned —
Debian 11 cloud Planned —
Debian 12 Planned —
RHEL 10 Planned —
RHEL 8 Planned —
RHEL 9 Planned —