SB2026062641 - Use-after-free in Linux kernel netfilter ipvs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026062641

SB2026062641 - Use-after-free in Linux kernel netfilter ipvs

Published: June 26, 2026

Security Bulletin ID SB2026062641
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-53270)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.

The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.


Remediation

Install update from vendor's website.

References