Skip to main content

Linux Kernel CVE-2026-53286

| EUVDEUVD-2026-39891 HIGH
Double Free (CWE-415)
2026-06-26 Linux GHSA-xv2m-p78g-cm3m
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local privileged access needed (AV:L/PR:L) and the fault triggers only on a hard-to-force aux-device probe error, so AC:H; kernel memory corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:09 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
7.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
HIGH 7.8
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix double free and use-after-free in aux device error paths

When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release callback (idpf_vport_adev_release / idpf_core_adev_release) that frees iadev. The fall-through then reads adev->id from the freed iadev for ida_free() and double-frees iadev with kfree().

Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately.

Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths.

AnalysisAI

Memory corruption (double free and use-after-free, CWE-415) in the Linux kernel's Intel idpf network driver allows a local low-privileged actor to corrupt kernel heap memory when the auxiliary device probe error path executes. The idpf_plug_vport_aux_dev() and idpf_plug_core_aux_dev() routines free the iadev structure via a release callback during auxiliary_device_uninit(), then fall through and read adev->id from the freed object for ida_free() and kfree() it again. It is not in CISA KEV and no public exploit has been identified; EPSS exploitation probability is low at 0.17% (7th percentile).

Technical ContextAI

The affected component is the idpf (Infrastructure Data Path Function) driver, Intel's Ethernet driver for IPU/foundational NIC devices, which uses the kernel auxiliary bus to register sub-function 'aux' devices for vport and RDMA core functionality. When auxiliary_device_add() fails during plug/probe, the err_aux_dev_add label calls auxiliary_device_uninit(), whose put_device() invokes the release callbacks idpf_vport_adev_release / idpf_core_adev_release that kfree() the iadev container. The subsequent fall-through to err_aux_dev_init then dereferences the already-freed iadev (reading adev->id, a use-after-free) and calls kfree() on it again (a double free), matching CWE-415. This mirrors an earlier bug fixed in commit 65637c3a1811 for the unplug/deinit path, which did not cover the two probe error paths corrected here by freeing the IDA slot and clearing the back-pointer before uninit.

RemediationAI

Patch available per vendor advisory: update to a Linux kernel build containing the fix, which frees the IDA slot and clears the back-pointer before auxiliary_device_uninit() and returns immediately. Apply the stable commits at https://git.kernel.org/stable/c/722b91d5086a249318c9d0e2b36aeac80ba8c808, https://git.kernel.org/stable/c/f319de7074e1728a9f9ff7134257360c694ec2b2, and https://git.kernel.org/stable/c/6c77b9510829a424d1b74409b7db9456e3522871, or upgrade to a fixed stable release (fixes reported around 6.18.33, 7.0.10, and 7.1) via your distribution's kernel update. Because the fault only manifests in the idpf aux-device probe error path, a targeted compensating control on unpatched hosts is to avoid loading the idpf driver where the hardware is absent (blacklist the module), and to restrict local privileged access on hosts that do use idpf NICs; note that blacklisting the module will disable those network interfaces, so it is only viable where idpf hardware is not in use.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro 6.2 Affected
SUSE Linux Micro Extras 6.2 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected

Share

CVE-2026-53286 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy