Skip to main content

Linux Kernel EUVDEUVD-2026-39221

| CVE-2026-53270 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-r42m-j2mw-2qf9
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only via IPVS admin so AV:L/PR:L; success depends on winning an RCU race during a scheduler swap, raising AC:H; UAF yields full memory read/corrupt impact C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:50 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear the svc scheduler ptr early on edit

ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period.

Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks.

Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code.

AnalysisAI

Use-after-free in the Linux kernel's IPVS (IP Virtual Server) load balancer allows a local privileged user to corrupt kernel memory by editing a virtual service's scheduler. ip_vs_edit_service() cleared svc->scheduler only after the old scheduler module had already initiated RCU callbacks, so in-flight packets could dereference svc->sched_data after it was freed at the end of the RCU grace period. The flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

IPVS is the in-kernel Layer-4 load balancer underpinning LVS and Kubernetes kube-proxy 'ipvs' mode, distributing connections across real servers using pluggable scheduler modules (rr, wrr, lc, sh, etc.). Each virtual service (struct ip_vs_service) holds a scheduler pointer and a scheduler-private sched_data blob, and the packet path reads these under RCU for lock-free performance. The bug is a classic use-after-free (CWE-416 / read-after-free): when an admin edits a service to swap schedulers, ip_vs_unbind_scheduler() invoked the old scheduler's done_service method - which frees sched_data via RCU callbacks - while svc->scheduler still pointed at the old scheduler, leaving a window where concurrent packets follow the stale pointer to freed memory after the grace period elapses. The fix clears svc->scheduler early in ip_vs_unbind_scheduler() before any RCU callback is scheduled, and additionally restores the old scheduler if the replacement fails to initialize while still propagating the error.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel for your branch - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or mainline 7.1, or your distribution's backport carrying the equivalent commits (see https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8 and the related stable commits). Where immediate patching is not possible, reduce exposure by avoiding live edits of IPVS virtual services that change the scheduler on production hosts (recreate services rather than editing scheduler in place), and restrict CAP_NET_ADMIN so untrusted users and unprivileged containers cannot administer IPVS - for example by disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 / user.max_user_namespaces=0), with the trade-off that some sandboxing and container tooling that relies on user namespaces will break. On hosts not using load balancing, unload or disable the ip_vs module (blacklist via modprobe) to remove the attack surface entirely; this is only safe where IPVS/LVS/kube-proxy ipvs mode is not in use.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy