Skip to main content

Linux Kernel EUVDEUVD-2026-39220

| CVE-2026-53269 MEDIUM
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-7m9q-85qj-rc4g
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires concurrent timing (AC:H); local low-privilege access needed; no confidentiality or integrity impact, only availability.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:13 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: add mutex to guard hook reference counting

As the synproxy infrastructure register netfilter hooks on-demand when a user adds the first iptables target or nftables expression, if done concurrently they can race each other.

Introduce a mutex to serialize the refcount control blocks access from both frontends. While a per namespace mutex might be more efficient, it is not needed for target/expression like SYNPROXY.

AnalysisAI

Denial-of-service via race condition in the Linux kernel's netfilter synproxy subsystem allows a local low-privileged user to crash the system by triggering concurrent netfilter hook registration. The synproxy infrastructure registers hooks on-demand when iptables targets or nftables expressions are added; without serialization, concurrent additions race on the reference count control blocks, corrupting kernel state. No public exploit exists and EPSS is 7th percentile (0.17%), but any Linux system running a kernel from 5.3 onward with the ability for unprivileged users to manipulate netfilter rules is technically exposed.

Technical ContextAI

The Linux kernel's netfilter SYNPROXY feature (introduced around kernel 5.3 via commit ad49d86e07a497e834cb06f2b151dccd75f8e148) registers netfilter hooks lazily - only when the first iptables SYNPROXY target or nftables SYNPROXY expression is added. This on-demand registration uses a reference counter to track active users across both frontends (iptables and nftables). Without a mutex protecting this refcount and associated control block, two threads or processes simultaneously adding SYNPROXY rules in the same network namespace can race during the hook registration path, leading to use-after-free or double-free conditions in kernel memory. The root cause is a classic TOCTOU/concurrency defect (functionally CWE-362: Race Condition) - the CWE field is listed as N/A in NVD, but the description and fix (introducing a per-subsystem mutex) confirm a concurrent access control failure. CPE data confirms the affected product is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable branches.

RemediationAI

Upgrade the Linux kernel to a patched stable version: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (final). Upstream fix commits are published at https://git.kernel.org/stable/c/ for each affected stable branch (see the eight commit references provided). Distribution-specific packages (RHEL, Debian, Ubuntu, SUSE) should be updated via the respective package manager as distro maintainers backport these fixes. As a compensating control where patching is not immediately possible, restrict the ability of non-root users to manipulate netfilter rules by ensuring user namespaces are limited (e.g., set kernel.unprivileged_userns_clone=0 on systems that support it, or restrict CAP_NET_ADMIN via seccomp/AppArmor/SELinux policies); this prevents unprivileged users from reaching the vulnerable code path, though it may impact container workloads that rely on user namespaces. Note that on systems where only root can add iptables/nftables rules, the practical risk is already reduced to privileged-user scenarios.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy