CVE Intelligence
Analysis AI-assisted

CVE-2026-53260: Linux kernel TCP request socket refcount underflow in reqsk_queue_hash_req (CWE-416)

The Linux kernel TCP stack has a request socket reference count underflow in reqsk_queue_hash_req(), classified as CWE-416 Use After Free and scored 9.8 (Critical) by the CNA. The upstream fix wraps timer setup and reference initialization in nested preemption-disabled sections. The affected ranges listed are 6.12 up to 7.0.13 and 7.1-rc1 through 7.1-rc6.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes a fix in the Linux kernel TCP stack, in the function reqsk_queue_hash_req(), for a request socket reference count underflow that syzbot reported on PREEMPT_RT kernels. The record classifies the weakness as CWE-416 Use After Free.

Impact

  • The reported defect is a refcount underflow on a request socket, which the record links to a use-after-free condition.
  • The CNA-provided CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The record does not describe the concrete consequences in a specific deployment, so the practical impact there is unknown.

Affected products and versions

  • Product: Linux Linux Kernel.
  • Listed ranges: 6.12 up to but not including 7.0.13, and 7.1-rc1 through 7.1-rc6.
  • The record lists no other affected versions. Stable branches outside these ranges are not addressed by the record, so their status is unknown.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The record contains no EPSS data.

Remediation and mitigation

  • Update to a Linux kernel release that includes the upstream stable fixes referenced by the record: commit b183215ff714 and commit e10902df2448.
  • Compare the running kernel version against the listed affected ranges, and treat builds with PREEMPT_RT enabled as a priority for review, since the reporter tied the defect to that configuration.
  • The record does not describe workarounds. Any mitigation other than patching is unknown.

Detection guidance

  • Review kernel logs for refcount warnings such as 'refcount_t: underflow', as shown in the trace included in the record.
  • Correlate such warnings with timer-driven request socket handling in the TCP stack. This is a high-level indicator only and does not confirm exploitation.

Limitations of the available information

  • The record has no title, so the title in this analysis was written from the description.
  • The CVSS score and severity come from the CNA record. No additional scoring source is present.
  • The record contains no KEV, EPSS or SSVC data for prioritization.
  • The root-cause explanation is the reporter's analysis as stated in the record. Its scope beyond the reported syzbot scenario is not established.

Frequently asked questions

Is this Linux kernel vulnerability known to be actively exploited?

No. The record shows the CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Which Linux kernel versions are listed as affected?

The record lists versions from 6.12 up to but not including 7.0.13, and 7.1-rc1 through 7.1-rc6. Other versions are not listed in the record.

What should administrators do?

Update to a kernel release that includes the upstream stable fixes referenced in the record and verify the running version against the listed ranges.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.