Use-after-free in Linux kernel - CVE-2026-52991

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU135393

Use-after-free in Linux kernel - CVE-2026-52991

Published: June 25, 2026


Vulnerability identifier: #VU135393
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52991
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.

The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.


Affected software

Linux kernel
Debian Linux
Anolis OS
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
openEuler
Ubuntu
IBM DataPower Gateway
linux-nvidia-tegra (Ubuntu package)
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-oracle (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-ibm (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-gke (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
kernel-rt (Red Hat package)
kernel-devel
kernel-tools-libs
kernel-tools
kernel-tools-libs-devel
perf
python3-perf
kernel-abi-stablelists
kernel-doc
kernel-modules-extra
kernel-modules
kernel-headers
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-source
kernel-tools-debuginfo
kernel-tools-devel
perf-debuginfo
python3-perf-debuginfo
kernel-extra-modules
linux (Debian package)

How to mitigate CVE-2026-52991

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
IBM DataPower Gateway - update to 11.0.0.3
linux-nvidia-tegra (Ubuntu package) - update to 6.8.0-1035.38
linux (Ubuntu package) - update to 7.0.0-28.28
linux-realtime (Ubuntu package) - update to 7.0.0-28.28.1
linux-gcp (Ubuntu package) - update to 7.0.0-1008.8
linux-aws (Ubuntu package) - update to 7.0.0-1009.9
linux-oracle (Ubuntu package) - update to 7.0.0-1008.8
linux-azure (Ubuntu package) - update to 7.0.0-1010.10
linux-raspi (Ubuntu package) - update to 7.0.0-1015.15
linux-nvidia (Ubuntu package) - update to 7.0.0-1016.16
linux-ibm (Ubuntu package) - update to 7.0.0-1010.10
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-gke (Ubuntu package) - update to 7.0.0-1003.4
linux-azure-fde (Ubuntu package) - update to 7.0.0-1009.9
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1016.16~24.04.1
kernel-rt (Red Hat package) - update to 4.18.0-553.157.1.rt7.498.el8_10
kernel-devel - update to 4.18.0-553.157.1.0.1
kernel-tools-libs - update to 4.18.0-553.157.1.0.1
kernel-tools - update to 4.18.0-553.157.1.0.1
kernel-tools-libs-devel - update to 4.18.0-553.157.1.0.1
perf - update to 4.18.0-553.157.1.0.1
python3-perf - update to 4.18.0-553.157.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.157.1.0.1
kernel-doc - update to 4.18.0-553.157.1.0.1
kernel-modules-extra - update to 4.18.0-553.157.1.0.1
kernel-modules - update to 4.18.0-553.157.1.0.1
kernel-headers - update to 4.18.0-553.157.1.0.1
kernel-debug-modules-extra - update to 4.18.0-553.157.1.0.1
kernel-debug-modules - update to 4.18.0-553.157.1.0.1
kernel-debug-devel - update to 4.18.0-553.157.1.0.1
kernel-debug-core - update to 4.18.0-553.157.1.0.1
kernel-debug - update to 4.18.0-553.157.1.0.1
kernel-cross-headers - update to 4.18.0-553.157.1.0.1
kernel-core - update to 4.18.0-553.157.1.0.1
kernel - update to 4.18.0-553.157.1.0.1
bpftool - update to 4.18.0-553.157.1.0.1
bpftool - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
bpftool-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-debugsource - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-headers - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-source - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-tools-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
python3-perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
python3-perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157, 6.6.0-145.3.26.157
kernel-extra-modules - update to 6.6.0-145.3.26.157
linux (Debian package) - update to 6.12.115-2

External References

Related Security Bulletins