CVE-2026-53175 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1
https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9
https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e
https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9
https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4

Type	Values Removed	Values Added
Weaknesses		CWE-416

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.
Title		inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1 https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9 https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9 https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53175", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.389Z", "datePublished": "2026-06-25T08:38:52.034Z", "dateUpdated": "2026-06-25T08:38:52.034Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-25T08:38:52.034Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: fix use-after-free caused by the fqdir_pre_exit() flush\n\nOn netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and\nflushes every fragment queue that is not yet complete using\ninet_frag_queue_flush(). That helper frees all the skbs queued on the\nfragment queue but does not set INET_FRAG_COMPLETE, and leaves\nq->fragments_tail and q->last_run_head pointing at the freed skbs.\nThe queue itself stays in the rhashtable.\n\nfqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups,\nbut it cannot stop a fragment that already obtained the queue through\ninet_frag_find() earlier and stalled just before taking the queue lock.\nOnce that fragment resumes after the flush and takes the queue lock,\nit passes the INET_FRAG_COMPLETE check and then dereferences the freed\nfragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of\nthat pointer and, on the append path, writes ->next_frag, causing a\nslab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly\nshare the same flush path and are affected as well.\n\nReset rb_fragments, fragments_tail and last_run_head in\ninet_frag_queue_flush() so a flushed queue no longer points at the\nfreed skbs. A fragment that resumes after the flush and takes the\nqueue lock then finds an empty queue and starts a new run instead of\ndereferencing the freed fragments_tail. ip_frag_reinit() already\nperformed this reset after its own flush, so drop the now duplicate\ncode there."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/inet_fragment.c", "net/ipv4/ip_fragment.c"], "versions": [{"version": "22ee4010866da81aeee08e1ea3fddbe418feb212", "lessThan": "0e823ca0e7391630784ae7dd0981b7ad170a93d9", "status": "affected", "versionType": "git"}, {"version": "543555954b1ee8d1903a7020324efb41b0c97428", "lessThan": "c22599cc90e1cd5f8129c8670bd68a02ff7177b4", "status": "affected", "versionType": "git"}, {"version": "c70df25214ac9b32b53e18e6ae3b8f073ffa6903", "lessThan": "89b909e9704587bfecc1aab1d37e98faee03b9f9", "status": "affected", "versionType": "git"}, {"version": "006a5035b495dec008805df249f92c22c89c3d2e", "lessThan": "010c3313a4d178dc2d3ce958d2e5cb055e2864c1", "status": "affected", "versionType": "git"}, {"version": "006a5035b495dec008805df249f92c22c89c3d2e", "lessThan": "32594b09854970d7ba83eb2dc8c69a2edd158c8e", "status": "affected", "versionType": "git"}, {"version": "6.12.93", "lessThan": "6.12.94", "status": "affected", "versionType": "semver"}, {"version": "6.18.3", "lessThan": "6.18.36", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/inet_fragment.c", "net/ipv4/ip_fragment.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.93", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.3", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9"}, {"url": "https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4"}, {"url": "https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9"}, {"url": "https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1"}, {"url": "https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e"}], "title": "inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22ee4010866da81aeee08e1ea3fddbe418feb212,0e823ca0e7391630784ae7dd0981b7ad170a93d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[543555954b1ee8d1903a7020324efb41b0c97428,c22599cc90e1cd5f8129c8670bd68a02ff7177b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c70df25214ac9b32b53e18e6ae3b8f073ffa6903,89b909e9704587bfecc1aab1d37e98faee03b9f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[006a5035b495dec008805df249f92c22c89c3d2e,010c3313a4d178dc2d3ce958d2e5cb055e2864c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[006a5035b495dec008805df249f92c22c89c3d2e,32594b09854970d7ba83eb2dc8c69a2edd158c8e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.93,6.12.94)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.3,6.18.36)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.94,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.36,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.13,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T12:30:06.246249+00:00", "updated": "2026-06-25T14:45:02.406951+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}

Metrics

Affected Vendors & Products

Metrics

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object

JSON object