Skip to main content

Linux Kernel EUVDEUVD-2026-38923

| CVE-2026-53055 CRITICAL
Use After Free (CWE-416)
2026-06-24 Linux GHSA-22hh-g7wj-354w
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local crypto-API access only (AV:L), exploitation needs winning a heavy-load timing race (AC:H), low-priv local use of the driver suffices (PR:L); kernel UAF yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:59 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: hisilicon/sec2 - prevent req used-after-free for sec

During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx.

AnalysisAI

Use-after-free in the Linux kernel's HiSilicon SEC2 crypto accelerator driver (crypto/hisilicon/sec2) allows local memory corruption when, under heavy load, the hardware completes and frees a request (req) before the software transmission path finishes referencing it. The fix replaces the freed req with the longer-lived qp_ctx pointer. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%); despite an NVD-style CVSS of 9.8, this is a local hardware-specific race rather than a remote, network-reachable flaw.

Technical ContextAI

The affected code is the SEC2 driver under drivers/crypto/hisilicon, which offloads symmetric crypto operations to HiSilicon SEC hardware queues (qp/qp_ctx) found on HiSilicon Kunpeng/Hi16xx server platforms. The root cause is a classic use-after-free (CWE-416, though CWE is marked N/A in the input): the asynchronous hardware completion path frees the per-request structure (req) while the synchronous send path may still dereference it - a lifetime/ownership race. The remediation anchors accesses to qp_ctx, queue-context memory that persists for the entire packet-sending lifecycle, eliminating the dangling reference.

RemediationAI

Upstream fix available (commits/stable patches); released patched version not independently confirmed beyond the stable references. Apply the stable kernel commits b375c3c7209cc59e40e97998aa9bc768369cca0e, ad73563f3a1edbfddf2724136c6a15826b354e18, and 67b53a660e6bf0da2fa8d8872e897a14d8059eaf (https://git.kernel.org/stable/c/b375c3c7209cc59e40e97998aa9bc768369cca0e and the two companion URLs), or upgrade to a distribution kernel that incorporates them (stable line referenced around 6.18.33). If you cannot patch immediately and the host has no HiSilicon SEC hardware, the driver is inert and risk is effectively nil; where the hardware is present, a compensating control is to blacklist/unload the hisilicon SEC2 module (e.g. prevent loading hisi_sec2) and fall back to software or alternate crypto, with the trade-off of losing hardware crypto offload and its throughput benefits. Restricting local access and reducing untrusted local workloads lowers the chance of triggering the heavy-load race but does not eliminate the bug.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38923 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy