Skip to main content

Linux Kernel EUVDEUVD-2026-39303

| CVE-2026-53212 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-j962-fx34-5263
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local CAP_NET_ADMIN needed (PR:L, AV:L); reliably winning the destroy-versus-dequeue race raises AC:H; kernel-memory UAF supports C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:34 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_tunnel: fix use-after-free on object destroy

nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory.

Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.

AnalysisAI

Local privilege escalation potential in the Linux kernel netfilter nf_tables tunnel module (nft_tunnel) stems from a use-after-free triggered when a tunnel object is destroyed while packets still hold a reference to its metadata_dst. The flawed nft_tunnel_obj_destroy() path calls metadata_dst_free(), which kfree()s the structure while ignoring the dst_entry refcount, so packets queued in a qdisc (e.g. netem) later call dst_release() on freed memory. CVSS is 7.8 (high) with CVSS:3.1 vector AV:L/PR:L; EPSS is low at 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability lives in net/netfilter/nft_tunnel.c, the nf_tables 'tunnel' stateful object that lets nftables attach tunnel (e.g. VXLAN/GRE/Geneve-style) metadata to packets via a metadata_dst (DST_METADATA dst_entry). During rule evaluation, nft_tunnel_obj_eval() takes a reference on the metadata_dst with dst_hold(), and that reference can outlive the rule when packets are buffered in a queuing discipline such as netem. On object teardown, nft_tunnel_obj_destroy() incorrectly called metadata_dst_free(), which performs an unconditional kfree() rather than honoring the dst reference count managed by the dst subsystem. This is a classic CWE-416 use-after-free (the input lists CWE as N/A, but the description explicitly states a use-after-free on object destroy): the lifetime of a reference-counted object is ended while live references remain. The fix replaces metadata_dst_free() with dst_release(), letting the dst core free the metadata_dst in dst_destroy() only once the refcount reaches zero, which it already handles correctly for DST_METADATA dsts.

RemediationAI

Upgrade to a Linux kernel that includes the fix replacing metadata_dst_free() with dst_release(): vendor-released patched versions are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and mainline 7.1 - apply the build matching your stable branch. The fix commits are published at git.kernel.org (for example https://git.kernel.org/stable/c/349df61526d2e39decc685d246202e3e284cfe05 and the other listed stable commits); distribution users should pull the corresponding distro kernel update referencing CVE-2026-53212. Where immediate patching is not possible, reduce exposure by denying CAP_NET_ADMIN to untrusted users and restricting unprivileged user namespace creation (e.g. sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0), since creating and destroying nft tunnel objects requires that capability - the trade-off is that this can break container runtimes and rootless workloads that legitimately rely on user namespaces. Avoiding nftables tunnel objects in combination with packet-buffering qdiscs (such as netem) on multi-tenant hosts narrows the race window but is not a reliable fix and may not be feasible for production traffic shaping.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39303 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy