CVE-2026-53275 - Vulnerability Details

- ipv6: mcast: Fix use-after-free when processing MLD queries

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: Fix use-after-free when processing MLD queries

When processing an MLD query, a pointer to the multicast group address
is retrieved when initially parsing the packet. This pointer is later
dereferenced without being reloaded despite the fact that the skb header
might have been reallocated following the pskb_may_pull() calls, leading
to a use-after-free [1].

Fix by copying the multicast group address when the packet is initially
parsed.

[1]
BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)
Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118

Workqueue: mld mld_query_work
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_address_description.constprop.0 (mm/kasan/report.c:378)
print_report (mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
__mld_query_work (net/ipv6/mcast.c:1512)
mld_query_work (net/ipv6/mcast.c:1563)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>

[...]

Freed by task 118:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
pskb_expand_head (net/core/skbuff.c:2335)
__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))
__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))
mld_query_work (net/ipv6/mcast.c:1563)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

Published: 2026-06-25

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the handling of MLD queries contains a use‑after‑free bug. A pointer to the multicast group address is stored in a packet structure during initial parsing and later dereferenced without reloading, after the skb may have been reallocated by pskb_may_pull() calls. This memory corruption can trigger a KASAN error and ultimately provide an attacker with a way to crash the kernel or execute arbitrary code. The weakness involves both a buffer misuse leading to use‑after‑free (CWE‑416) and a classic use‑after‑free bug (CWE‑825).

Affected Systems

All Linux kernel implementations that do not include the patch, regardless of distribution, are affected. No specific version ranges are listed in the advisory; therefore, any kernel that predates the fix is considered vulnerable.

Risk and Exploitability

The likely attack vector is a crafted MLD query sent over the network, as inferred from the description. The EPSS score is < 1% and the CVSS score is 8.8, classifying it as a high‑severity kernel use‑after‑free (CWE‑416 & CWE‑825). The vulnerability is not listed in CISA’s KEV catalog, but the nature of the memory corruption could allow an attacker to crash the kernel or gain kernel‑level execution. Without a patch, the likelihood of active exploitation remains uncertain, though the potential impact is significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 1354271c89d0e5fbf8b3d94097ff0216695209c7
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 53baa63a4183291574483f89583dbef13677a2c4
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 2a613bf497029d555a7428406aa8cdb84a503cea
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< b2eb8886200b907fc71806869620609f0f4cacb0
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 4203806f700bb44ea0b05d484d9d40044b47fb04
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 087dbacf897c020f438f780f0a4a8aa73b6d7c5a
`97300b5fdfe28c6edae926926f9467a27cf5889c`	affected	< 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40

Linux

affected

Version	Status	Constraints
`2.6.15`	affected	—
`0`	unaffected	< 2.6.15
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[97300b5fdfe28c6edae926926f9467a27cf5889c,1354271c89d0e5fbf8b3d94097ff0216695209c7)`	affected	code_commit	—
`[97300b5fdfe28c6edae926926f9467a27cf5889c,53baa63a4183291574483f89583dbef13677a2c4)`	affected	code_commit	—
`[97300b5fdfe28c6edae926f9467a27cf5889c,2a613bf497029d555a7428406aa8cdb84a503cea)`	affected	code_commit	—
`[97300b5fdfe28c6edae926926f9467a27cf5889c,b2eb8886200b907fc71806869620609f0f4cacb0)`	affected	code_commit	—
`[97300b5fdfe28c6edae926926f9467a27cf5889c,4203806f700bb44ea0b05d484d9d40044b47fb04)`	affected	code_commit	—
`[97300b5fdfe28c6edae926926f9467a27cf5889c,087dbacf897c020f438f780f0a4a8aa73b6d7c5a)`	affected	code_commit	—
`[97300b5fdfe28c6edae926926f9467a27cf5889c,791c91dc7a9dfb2457d5e29b8216a6484b9c4b40)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.15`	affected	semver	—
`[0,2.6.15)`	unaffected	semver	—
`[5.15.210,5.15.*]`	unaffected	semver	—
`[6.1.176,6.1.*]`	unaffected	semver	—
`[6.6.143,6.6.*]`	unaffected	semver	—
`[6.12.94,6.12.*]`	unaffected	semver	—
`[7.0.13,7.0.*]`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch for this use‑after‑free bug
If upgrading is not immediately possible, restrict or block MLD queries by configuring firewall rules or disabling IPv6 multicast handling on the affected interfaces to reduce exposure
Monitor system logs for KASAN or kernel panic messages that may indicate an attempt to exploit memory corruption

Generated by OpenCVE AI on August 12, 2026 at 08:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00232.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a
https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7
https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea
https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04
https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4
https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40
https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0
https://lore.kernel.org/linux-cve-announce/2026062519-CVE-2026-53275-88a6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53275
https://www.cve.org/CVERecord?id=CVE-2026-53275

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026062519-CVE-2026-53275-88a6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53275 https://www.cve.org/CVERecord?id=CVE-2026-53275
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 12:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK> [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Title		ipv6: mcast: Fix use-after-free when processing MLD queries
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7 https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04 https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4 https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:59.115Z

Updated: 2026-08-05T12:34:51.568Z

Reserved: 2026-06-09T07:44:35.395Z

Link: CVE-2026-53275

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-25T09:16:45.687

Modified: 2026-07-08T04:00:32.483

Link: CVE-2026-53275

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53275 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-12T08:45:02Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object