Skip to main content

Linux Kernel CVE-2026-53006

| EUVDEUVD-2026-38874 CRITICAL
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-f2fg-xhhc-4m4w
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted ICMPv6 packet
  2. Exploit
    Trigger slow-path pskb_pull reallocation
  3. Execution
    Dangling saddr/daddr dereferenced in debug log
  4. Impact
    Leak freed memory or crash

Vulnerability Assessment

Weakness
CWE
CWE-825
ASVS 5.0
V15 - Secure Coding and Architecture Expired pointer prevention
Exploitation Conditions

Exploitation requires two non-default conditions: (1) kernel network debug logging must be active, because the stale saddr/daddr pointers are dereferenced only inside net_dbg_ratelimited() on the slow path, and (2) an incoming ICMPv6 packet must trigger a pskb_pull() that actually relocates skb->head, a reallocation race. The attacker can reach the code remotely by sending ICMPv6 traffic (no authentication, per PR:N), but the debug-logging-disabled-by-default state and the race requirement substantially limit realistic exploitation; against a default production configuration with debug logging off, the vulnerable code path is not reached.
Impact

The signals conflict sharply and should be reconciled before prioritization. The supplied CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects an automated worst-case rating typical of bulk Linux CVE assignments and overstates real risk: the dangling pointers are consumed only by net_dbg_ratelimited() in a slow/error path, so the UAF is unreachable unless network debug logging is enabled, and the worst realistic outcome is reading stale header bytes for a log line (information disclosure, consistent with the 'Information Disclosure' tag) or a potential crash - not full confidentiality/integrity/availability compromise. The corroborating signals agree with the lower assessment: EPSS is 0.18% (8th percentile), the CVE is not in CISA KEV, and no POC is referenced - so this is a high-CVSS-but-low-real-risk issue rather than an urgent priority. Note the explicit conflict: CVSS claims C:H/I:H/A:H and AC:L, but the description constrains the bug to a debug-only slow path with a reallocation race, which argues for high attack complexity and at most low impact - verify against the kernel commit before treating the 9.8 as authoritative.
Exploit ScenarioDerived

An attacker on a network path to the target sends crafted ICMPv6 packets that take the error/slow path in icmpv6_rcv() while conditions cause pskb_pull() to reallocate the skb buffer, so the kernel logs using pointers into freed memory. On a host with network debug logging enabled this can leak stale buffer contents into kernel logs or destabilize the system; no public exploit code is identified at time of analysis and reliable triggering depends on a memory-reallocation race.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use-after-free in the Linux kernel's IPv6 ICMPv6 receive path (icmpv6_rcv()) allows stale pointers to freed socket buffer memory to be dereferenced after a pskb_pull() call relocates skb->head. The affected code cached the source and destination addresses (saddr/daddr) before the pull, and these stale references were only consumed by net_dbg_ratelimited() in the slow path, limiting practical impact. The flaw is fixed upstream across all maintained stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or mainline 7.1 (or your distribution's backported equivalent). Apply the corresponding stable commit referenced on git.kernel.org (e.g. https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94) if you maintain your own kernel build. As an interim compensating control, ensure verbose network-stack debug logging is not enabled in production (the vulnerable path is only reached via net_dbg_ratelimited()), since disabling kernel network debug output prevents the dangling pointers from ever being dereferenced - the trade-off is reduced packet-level diagnostics during troubleshooting. There is no need to disable IPv6 itself, which would be disruptive and is not warranted given the low real-world risk.

Affected VersionsENISA

Linux patch: 5.10.258
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <7c66b368c6ff453f99cb39d84af93e908e51eef2
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <f996edd7615e686ada141b7f3395025729ff8ccb
Linux patch: 7.0.10
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <aff0f28f5be803de2452ce702631c021fcd9ce8a
Linux patch: 6.6.141
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <085e31a811ef234ef8c3e219c4636dfebfe7e10f
Linux patch: 6.18.33
Linux patch: 5.15.209
Linux patch: 0
Linux patch: 7.1
Linux patch: 6.1.175
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <7bff2c8fe5c35ae58bf73104f53db3676e6e5d94
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <0069813e6ca9309eca78022bcb3aeb1e9ef90a12
Linux 4.4
Linux patch: 6.12.91
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <38bdbc897c0d83a3e2b925a51b69420f1feba29a
Linux 4b3418fba0fe819197e3359d5ddbef84ba2c59de <1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the IPv6 ICMP input handler (net/ipv6/icmp.c, icmpv6_rcv()) of the Linux networking stack. A socket buffer (skb) holds packet data in a buffer referenced by skb->head; calling pskb_pull() can linearize/reallocate that buffer, invalidating any previously taken pointers into it. The buggy code stored &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr in temporary variables before the pull, creating dangling pointers - a classic CWE-416 use-after-free (the input lists CWE as N/A, but the root cause is unambiguously a temporal memory-safety error). These dangling references were only read inside net_dbg_ratelimited() on an error/slow path, so the defect surfaces only when kernel network debug logging is active. CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the upstream kernel itself.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.8 MEDIUM

Remotely reachable via ICMPv6 (AV:N, PR:N) but needs a reallocation race plus enabled debug logging (AC:H); impact is limited to a memory-disclosure log leak or crash, so C:L/A:L and I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
CRITICAL 9.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible UAF in icmpv6_rcv()

Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.

Remove these temporary variables:

  • We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr

when net_dbg_ratelimited() is called in the slow path.

  • Avoid potential future misuse after pskb_pull() call.

Executive ViewAI

Why It Matters

A critical Linux kernel vulnerability (CVE-2026-53006) affecting IPv6 network processing impacts server and network infrastructure across organizations running affected kernel versions. Despite CVSS 9.8 severity, real-world exploitation probability is very low (0.2% EPSS, no public exploits identified), requiring standard patch priority rather than emergency response. Organizations should apply available kernel updates through normal change management procedures.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a vast fraction of servers and devices
Threat Intel
1
1 sources
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2025-49795 HIGH POC
7.5
CVE-2026-58592 HIGH POC
8.9
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-52924 CRITICAL
9.8
CVE-2023-48694 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-11
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:45192 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53006 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373330 REF https://access.redhat.com/errata/RHSA-2026:47010 REF https://access.redhat.com/errata/RHSA-2026:47011 REF https://access.redhat.com/errata/RHSA-2026:47017 REF https://access.redhat.com/errata/RHSA-2026:61932 REF https://access.redhat.com/errata/RHSA-2026:62568 REF https://access.redhat.com/errata/RHSA-2026:64767 REF https://access.redhat.com/errata/RHSA-2026:65710 REF https://access.redhat.com/errata/RHSA-2026:65711 REF https://access.redhat.com/errata/RHSA-2026:65712 REF https://access.redhat.com/errata/RHSA-2026:67721 REF https://access.redhat.com/errata/RHSA-2026:67723 REF https://access.redhat.com/security/cve/CVE-2026-53006 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492363 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12 REF https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f REF https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7 REF https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a REF https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94 REF https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2 REF https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a REF https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy