Skip to main content

Linux Kernel CVE-2026-53296

| EUVDEUVD-2026-39901 HIGH
Use After Free (CWE-416)
2026-06-26 Linux GHSA-h624-59g3-97r5
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Local vector; triggering a probe-error UAF needs module-load/hardware-binding control (PR:H) and a race-like error path (AC:H), but successful exploitation yields full kernel compromise (C/I/A:H).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:12 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
7.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
HIGH 7.8
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mailbox-test: free channels on probe error

On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.

AnalysisAI

Use-after-free in the Linux kernel's mailbox-test debug driver (mailbox-test.c) allows a local privileged attacker to corrupt kernel memory when the driver's probe routine fails, because previously acquired mailbox channels are not released while the devm-allocated client structure is freed anyway. The flaw carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact, but exploitation is local and requires the mailbox-test module to load and hit a probe error path. No public exploit is identified at time of analysis and EPSS estimates exploitation probability at only 0.18%.

Technical ContextAI

The affected component is drivers/mailbox/mailbox-test.c, a test/debug client for the Linux kernel mailbox subsystem, which provides a framework for inter-processor and controller communication channels (mbox_request_channel). The root cause is CWE-416 (Use-After-Free): on a probe error, the driver returns without calling mbox_free_channel on the channels it already obtained, yet the surrounding client structure is torn down because it was allocated with devm managed resources. This leaves the mailbox core holding references into a freed client object, so later channel operations dereference dangling pointers. CPE data identifies the product as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel, not a distribution-specific package.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 or later, per your maintained branch, applying the commits at https://git.kernel.org/stable/c/6c6ce2ccb4fcf1617fec83f91b21aa0265f30701 and the sibling backports. If immediate patching is not possible, the highest-value compensating control is to ensure the mailbox-test driver is not built or loaded: unset CONFIG_MAILBOX_TEST in the kernel config, or blacklist the mbox-test module (e.g. via /etc/modprobe.d) so the vulnerable probe path is never reached - this has essentially no production side effect since the driver exists only for testing. Restrict physical and administrative access that would allow loading test modules or manipulating device-tree/ACPI mailbox bindings that trigger probe failures.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53296 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy