CVE Intelligence
Analysis AI-assisted

CVE-2026-53175: Linux kernel inet fragment use-after-free during netns teardown flush

CVE-2026-53175 is a use-after-free (CWE-416) in the Linux kernel's inet fragment reassembly code. Incomplete fragment queues flushed during network namespace teardown keep pointers to freed buffers, which a late-resuming fragment can dereference. The CNA scores it 9.8 (critical) under CVSS 3.1, and the record shows no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53175 affects the inet fragment handling code in the Linux kernel. During network namespace teardown, the fragment queue flush path frees queued buffers but leaves stale pointers in the queue. A fragment that obtained the queue earlier and resumes after the flush can dereference those stale pointers. The record classifies the weakness as CWE-416 (Use After Free).

Impact

  • The CNA-provided CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • A second score of 7 under CVSS 3.1 appears in the record from a provider that is identified only by an ID.
  • The description says the flaw can cause a slab use-after-free. The record does not describe consequences beyond that.

Affected products and versions

The record lists the product as Linux Linux Kernel with these entries:

  • Release candidates: version 6.19-rc2 through 6.19-rc8, version 6.19, and version 7.1-rc1 through 7.1-rc7.
  • Stable ranges: 6.18.3 or later and before 6.18.36, and 6.19.1 or later and before 7.0.13.
  • Also listed: version 6.12.93, without a range.

The record does not state fixed versions directly. The upper bounds of the ranges suggest fixes in later stable releases, which is an inference. Confirm against the referenced stable commits and your distribution's advisories.

Exploitation status

The record shows KEV listing as false. No confirmed exploitation appears in the sources consulted. EPSS data is not present in the record.

Remediation and mitigation

  • Update to a kernel release that includes the stable commits listed in the record, using the stable branch that matches your system.
  • Prioritize hosts that process untrusted IP fragments or run workloads that use IPv6, netfilter reassembly or 6LoWPAN, since the description names these paths.
  • Follow your distribution's advisory for backport status and any reboot requirements. The record links Red Hat tracking pages.
  • Interim mitigations that do not require patching are unknown from the available information.

Detection guidance

  • Inventory kernel versions across the estate and compare them with the affected ranges and listed versions.
  • Review kernel logs for memory-safety reports (such as KASAN or slab errors) that reference fragment reassembly or network namespace teardown. This is a general defensive check and does not confirm exploitation.

Limitations of the available information

  • The record does not provide reproduction details, proof-of-concept material or exploitation prerequisites beyond the description.
  • The meaning of the listed 6.12.93 entry, which has no range, is unclear from the record.
  • The provider of the second CVSS score of 7 is not named.
  • EPSS is absent and the record is marked as Modified by the source.

Frequently asked questions

What is CVE-2026-53175?

It is a use-after-free (CWE-416) in the Linux kernel's inet fragment reassembly code, triggered when fragment queues are flushed during network namespace teardown.

Is CVE-2026-53175 known to be actively exploited?

The record shows KEV listing as false, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update to a kernel release containing the stable commits listed in the record, following your distribution's advisory for backport status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.