Skip to main content

Linux Kernel CVE-2026-53233

| EUVDEUVD-2026-39324 HIGH
Double Free (CWE-415)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-wr67-pp59-29qp
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local netlink caller (AV:L, PR:L); AC:H because the double-free only fires when genlmsg_reply() is forced to fail (full rcvbuf), and kernel memory corruption yields C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 07, 2026 - 23:53 vuln.today
CVSS changed
Jul 07, 2026 - 23:52 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netdev: fix double-free in netdev_nl_bind_rx_doit()

Sashiko flags that genlmsg_reply() always consumes the skb. The error path calls nlmsg_free(rsp) so we can't jump directly to it. Let's not unbind, just propagate the error to the user. This is the typical way of handling genlmsg_reply() failures. They shouldn't happen unless user does something silly like calling the kernel with an already-full rcvbuf.

AnalysisAI

Local memory corruption (double-free) in the Linux kernel netdev generic-netlink interface affects the device-memory RX binding path (netdev_nl_bind_rx_doit) in kernels 7.1-rc1 through 7.1-rc7 and backport-affected stable branches. Because genlmsg_reply() unconditionally consumes the reply skb, the buggy error path then calls nlmsg_free() on that same buffer, freeing it a second time; a local user able to reach the BIND_RX netlink command and force a reply failure can trigger the flaw. There is no public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a hard-to-reach error path rather than easy exploitation.

Technical ContextAI

The bug lives in the generic-netlink (genl) subsystem of the kernel networking stack, in the netdev family handler netdev_nl_bind_rx_doit(), which binds an RX queue to a dmabuf for zero-copy / device-memory TCP receive. The root cause is CWE-415 (Double Free): genlmsg_reply() always takes ownership of and frees the response skb regardless of success or failure, but the original code additionally jumped to an error label that called nlmsg_free(rsp) on that already-consumed skb. The upstream fix stops treating a genlmsg_reply() failure as a reason to unbind and instead simply propagates the error code to the caller, the standard idiom for genlmsg_reply() failure handling. Affected products per CPE are Linux kernel builds, including the tagged pre-releases 7.1-rc1 through 7.1-rc7.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build - 7.0.13, 6.12.94, 6.18.36, or 7.1 (or later) depending on your branch - via the stable-tree commits at https://git.kernel.org/stable/c/9b019376cbee10c4f9184d1745fa37d156e36f30 and the companion commits (c299321bc6232770ce378d6fa6bc46004d2d7fdb, c849de7d8757a7af801fc4a4058f71d481d367f2, e055ca9205d3eb6aec3e5fe4ecc18abbbf18c599); consume the fix through your distribution's kernel update channel. If you cannot patch immediately, the practical compensating control is to restrict who can reach the netdev generic-netlink BIND_RX command - device-memory / zero-copy RX binding is an uncommon feature, so on hosts that do not use it you can reduce exposure by not granting untrusted local users the capabilities/namespaces needed to issue that netlink command, at the cost of blocking legitimate dmabuf RX setup for those users. Because the trigger requires a genlmsg_reply() failure (e.g. an already-full receive buffer) there is no clean feature toggle beyond the kernel update, so prioritize the patch.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53233 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy