What is the CVSS score of CVE-2026-53156?

CVE-2026-53156 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux are affected by CVE-2026-53156?

A use-after-free vulnerability in the Linux kernel's nvmem subsystem enables local privilege escalation and memory corruption across all Linux-based infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-53156?

Within 24 hours: Inventory all Linux systems and identify kernel versions against upstream stable releases (check kernel.org advisory). Within 7 days: Test stable kernel patches in non-production environment; deploy to critical servers prioritizing multi-tenant systems and those allowing untrusted local users. Within 30 days: Complete kernel updates across all Linux systems; coordinate with your distribution (RHEL, Ubuntu, Debian, etc.) for patch release timelines and schedule maintenance windows accordingly.

Linux CVE-2026-53156

EUVD-2026-39247 HIGH

Use After Free (CWE-416)

2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-2wqp-vx6w-rvfx

Memory Corruption Linux Use After Free Information Disclosure

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 16:54 vuln.today

CVSS changed

Jul 06, 2026 - 16:52 NVD

7.8 (HIGH)

Patch available

Jun 25, 2026 - 10:32 EUVD

CVE Published

Jun 25, 2026 - 09:16 nvd

HIGH 7.8

CVE Published

Jun 25, 2026 - 09:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvmem: core: fix use-after-free bugs in error paths

Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error code.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's nvmem core subsystem arises from use-after-free bugs in multiple error paths where __nvmem_device_put() releases the nvmem device (and its backing memory/resources) but the code continues to dereference the freed structure before returning. A local, low-privileged user able to trigger these error paths can corrupt kernel memory, potentially leading to code execution or information disclosure. …