Skip to main content

Linux Kernel EUVDEUVD-2026-39899

| CVE-2026-53294 HIGH
Double Free (CWE-415)
2026-06-26 Linux GHSA-grhq-rqc2-rhjr
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.7 MEDIUM

Triggering needs privileged debugfs access (PR:H) and a specific RX-aliases-TX configuration (AC:H); impact is kernel memory corruption enabling code execution and DoS, with no direct confidentiality disclosure (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:11 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
7.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
HIGH 7.8
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mailbox-test: don't free the reused channel

The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs.

AnalysisAI

Local privilege escalation potential in the Linux kernel's mailbox-test driver arises from a double-free when the RX channel is aliased to the TX channel (a valid configuration when they use different MMIO regions); the cleanup path frees the reused channel twice. Affecting the mailbox subsystem's test/debug driver across a wide range of stable branches (5.10 through 7.x), the flaw carries a 7.8 CVSS with an AV:L/PR:L vector and has an upstream fix, but EPSS is only 0.18% and there is no public exploit identified at time of analysis.

Technical ContextAI

The affected component is drivers/mailbox/mailbox-test.c, a test harness for the kernel mailbox framework used to exercise inter-processor/controller communication channels via debugfs. The driver can request both a TX and an RX mailbox channel; when the RX channel is merely an alias of the TX channel (permitted when a distinct MMIO region is present), the two channel pointers reference the same underlying object. The root cause is CWE-415 (Double Free): the release path calls mbox_free_channel() on both handles without recognizing they point to the same channel, so the same allocation is freed twice. A double-free corrupts the kernel slab allocator's free-list metadata, which, depending on allocator (SLUB) hardening and heap grooming, can lead to use-after-free conditions, memory corruption, and potentially arbitrary kernel code execution or a denial of service.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (whichever matches your series), or apply your distribution's backport of the upstream fix once available. The fix teaches the mailbox-test cleanup path to detect that the RX channel is an alias of the TX channel and avoid freeing it twice; corresponding stable commits are linked from git.kernel.org (e.g., https://git.kernel.org/stable/c/fc0089f82c3e36060c2c79156bc2018bfb16b56b and siblings). As a compensating control on systems that cannot patch immediately, do not build/load the mailbox-test module (CONFIG_MAILBOX_TEST) in production kernels - it is a debug/test driver with no operational role, so disabling it removes the attack surface with negligible side effects; additionally restrict access to debugfs by unmounting it or tightening its mount permissions (mount options / root-only access), accepting that this may hinder other debugging tooling that relies on debugfs.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy