Use-after-free in Linux kernel - CVE-2026-53228

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU135550

Use-after-free in Linux kernel - CVE-2026-53228

Published: June 26, 2026


Vulnerability identifier: #VU135550
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53228
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ipip6_tunnel_xmit() function in the SIT IPv6 tunneling implementation when handling GSO packets after offload processing. A local user can trigger transmission of a crafted packet to disclose sensitive information.

The issue occurs because a cached inner IPv6 header pointer may become stale if the skb head is moved during offload handling, and the stale pointer may later be used to read header fields.


Affected software

Linux kernel
Ubuntu
openEuler
linux (Ubuntu package)
linux-aws-hwe (Ubuntu package)
linux-oracle (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
bpftool
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
kernel-tools-debuginfo
kernel-tools
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel
linux-lowlatency (Ubuntu package)
linux-azure-6.17 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-aws-7.0 (Ubuntu package)

How to mitigate CVE-2026-53228

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 4.15.0.254.238, 4.15.0-254.266, 4.15.0.1150.147, 4.15.0-1150.162, 4.15.0.1177.168, 4.15.0-1177.182, 4.15.0.1188.201~16.04.1, 4.15.0-1188.205, 4.15.0.1195.193, 4.15.0-1195.208, 4.15.0.1205.173, 4.15.0-1205.220, 4.15.0.2096.94, 4.15.0-2096.102, 4.15.0.2113.109, 4.15.0-2113.119, 4.15.0.2133.127, 4.15.0-2133.139, 5.15.0.187.167, 5.15.0-187.197, 5.15.0.1065.65, 5.15.0-1065.67, 5.15.0-1065.67~20.04.1, 5.15.0.1076.79~20.04.1, 5.15.0-1076.80, 5.15.0.1096.95, 5.15.0-1096.104, 5.15.0.1105.101, 5.15.0-1105.107, 5.15.0.1105.109, 5.15.0-1105.110, 5.15.0.1107.104, 5.15.0.1107.111, 5.15.0-1107.111~20.04.1, 5.15.0.1108.107, 5.15.0.1108.108, 5.15.0-1108.109, 5.15.0-1108.114, 5.15.0-1108.114~20.04.1, 5.15.0-1110.116~20.04.1, 5.15.0.1112.116, 5.15.0-1112.121, 5.15.0.1113.109, 5.15.0.1113.116, 5.15.0-1113.120, 5.15.0-1113.120+fips1, 5.15.0.1118.103, 5.15.0.1118.116, 5.15.0-1118.127, 5.15.0-1118.127+fips1, 6.8.0-137.137+fips1, 6.8.0-1034.35, 6.8.0-1047.51, 6.8.0-1060.63.1, 6.8.0-1060.63~22.04.1, 6.8.0-1060.68, 6.8.0-1062.63, 6.8.0-1062.63~22.04.1, 6.8.0-1062.65, 6.8.0-1062.65+fips1, 6.8.0-1063.70, 6.8.0-1063.70~22.04.1, 6.8.0-1064.72+fips1, 6.8.0-1064.72~22.04.1, 6.8.0-1065.73, 6.8.0-1065.73+fips1, 6.8.0-1065.73~22.04.1, 6.8.1-1057.58, 6.8.1-1057.58~22.04.1, 7.0.0-29.29, 7.0.0-29.29.1, 7.0.0-1009.9, 7.0.0-1010.10, 7.0.0-1011.11, 7.0.0-1016.16
linux-aws-hwe (Ubuntu package) - addressed in versions 4.15.0-254.266~16.04.1, 4.15.0-1188.205~16.04.1, 4.15.0-1195.208~16.04.1, 4.15.0-1205.220~16.04.1
linux-oracle (Ubuntu package) - addressed in versions 4.15.0.1158.163, 4.15.0-1158.169, 4.15.0-1158.169~16.04.1, 5.15.0.1110.106, 5.15.0-1110.116
linux-azure (Ubuntu package) - update to 4.15.0-1205.220~14.04.1
linux-nvidia-tegra-igx (Ubuntu package) - addressed in versions 5.15.0-1054.54, 5.15.0.1054.56
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1118.127~20.04.1
bpftool - update to 6.6.0-145.1.20.157
kernel-source - update to 6.6.0-145.1.20.157
kernel-headers - update to 6.6.0-145.1.20.157
kernel-devel - update to 6.6.0-145.1.20.157
kernel-debugsource - update to 6.6.0-145.1.20.157
kernel-debuginfo - update to 6.6.0-145.1.20.157
bpftool-debuginfo - update to 6.6.0-145.1.20.157
kernel-tools-debuginfo - update to 6.6.0-145.1.20.157
kernel-tools - update to 6.6.0-145.1.20.157
kernel-tools-devel - update to 6.6.0-145.1.20.157
perf - update to 6.6.0-145.1.20.157
perf-debuginfo - update to 6.6.0-145.1.20.157
python3-perf - update to 6.6.0-145.1.20.157
python3-perf-debuginfo - update to 6.6.0-145.1.20.157
kernel - update to 6.6.0-145.1.20.157
linux-lowlatency (Ubuntu package) - addressed in versions 6.8.0-137.137.1, 6.8.0-137.137.1~22.04.1, 6.8.0-1031.32, 6.8.0-1059.62
linux-azure-6.17 (Ubuntu package) - addressed in versions 6.17.0-42.42+1, 6.17.0-1019.22, 6.17.0-1022.22, 6.17.0-1022.25, 6.17.0-1032.32
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1010.10
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1010.10~24.04.1

External References

Related Security Bulletins