CVE-2026-53157 - Vulnerability Details

- net: phonet: free phonet_device after RCU grace period

Description

In the Linux kernel, the following vulnerability has been resolved:

net: phonet: free phonet_device after RCU grace period

phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.

Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.

Published: 2026-06-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The phonet subsystem in the Linux kernel removes a phonet_device from its network list using list_del_rcu() but deallocates it immediately with kfree. This mismatch allows an RCU reader to access the device after it has been freed, producing a slab‑use‑after‑free that can corrupt kernel memory. The vulnerability is classified as CWE‑416 and CWE‑825 and could lead to privilege escalation or denial of service if exploited.

Affected Systems

The flaw exists in all Linux kernel releases that still contain the unsafe free call in phonet_device_destroy(), regardless of distribution. The CPE data includes kernel 7.1 release candidates and any earlier builds not yet patched. Administrators should verify whether their kernel includes the fix that replaces the immediate free with kfree_rcu.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score of <1% shows exploitation is unlikely, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would require an attacker to interact with the phonet subsystem during a device removal event, such as sending specific phonet traffic or provoking a device teardown. This scenario is inferred from the description and not explicitly documented.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< d59794337ea496042288c7c68356d9b9ca7f46a9
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< 6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< 2ec8011cce0cd0fc7a5068585d867fc08d508578
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< 09c9b92c2010481160245244ea8fa1d06d5d4ae0
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< bd2ab4d800fc26814d89328d87b5f97ef6aa906a
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< 52b8f5ef82c886f7cd24617915e4b1579ddfd001
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< bff309ea51f1395c1ef8be8b75ce62d28a319113
`eeb74a9d45f781ec6f47b9e0a75a6a427b53f165`	affected	< 71de0177b28da751f407581a4515cf4d762f6296

Linux

affected

Version	Status	Constraints
`2.6.33`	affected	—
`0`	unaffected	< 2.6.33
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eeb74a9d45f781ec6f47b9e0a75a6a427b53f165,52b8f5ef82c886f7cd24617915e4b1579ddfd001)`	affected	code_commit	—
`[eeb74a9d45f781ec6f47b9e0a75a6a427b53f165,bff309ea51f1395c1ef8be8b75ce62d28a319113)`	affected	code_commit	—
`[eeb74a9d45f781ec6f47b9e0a75a6a427b53f165,71de0177b28da751f407581a4515cf4d762f6296)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.33`	affected	semver	—
`[0,2.6.33)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a build that includes the commit replacing the immediate kfree with kfree_rcu for phonet_device_destroy().
If a kernel upgrade cannot be applied, disable the phonet module or block phonet traffic with host‑based filtering to limit exposure.
Alternatively, apply the upstream patch to the kernel source and rebuild the kernel to use kfree_rcu for device deallocation.

Generated by OpenCVE AI on August 13, 2026 at 15:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4688-1	linux security update
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update
Debian DSA	DSA-6381-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0
https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578
https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001
https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763
https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296
https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a
https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113
https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9
https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53157-7e36@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53157
https://www.cve.org/CVERecord?id=CVE-2026-53157

History

Sat, 04 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0 https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578 https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9

Fri, 26 Jun 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53157-7e36@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53157 https://www.cve.org/CVERecord?id=CVE-2026-53157
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.
Title		net: phonet: free phonet_device after RCU grace period
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001 https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296 https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:38:40.132Z

Updated: 2026-07-04T11:50:55.214Z

Reserved: 2026-06-09T07:44:35.388Z

Link: CVE-2026-53157

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-25T09:16:33.073

Modified: 2026-07-07T18:54:28.800

Link: CVE-2026-53157

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53157 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T15:15:13Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object