Use-after-free in Linux kernel - CVE-2026-53270

Vulnerability identifier: #VU135474

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53270

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.

The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.

Linux kernel
openEuler
bpftool
kernel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
bpftool - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
python3-perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
python3-perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
perf-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
perf - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-tools-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-tools-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-tools - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-source - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-headers - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-devel - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-debugsource - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
kernel-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157
bpftool-debuginfo - addressed in versions 5.10.0-323.0.0.224, 6.6.0-145.1.20.157

• https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33
• https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b
• https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03
• https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3
• https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5
• https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69
• https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06
• https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8

• Use-after-free in Linux kernel netfilter ipvs
• openEuler 22.03 LTS SP4 update for kernel
• openEuler 24.03 LTS SP1 update for kernel