GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53011 (GCVE-0-2026-53011)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-05 12:32
VLAI
Title
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->end_time = end_time' and rcu_assign_pointer(q->current_entry, next) are use-after-free. Fix this by selecting 'next' from the new oper schedule immediately after switch_schedules(), and using its pre-calculated end_time. setup_first_end_time() sets the first entry's end_time to base_time + interval when the schedule is installed, so the value is already correct. The deleted 'end_time = sched_base_time(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated end_time with just base_time.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < a8fc396519ef4f081bc545e88f61241728bb78d7 (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < 3471874578160a28c171a607fa069f24062634b8 (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < 7256996e1ef553716817f3bfd077c2f3b48b582f (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < eee072fe16c646190d33ae69c9983d8de1562bf8 (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < 1bd286fa3e21200133478ed523cc6a2788baf38a (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < b73235da5dde77ed1264f9767b62c28c9d71fd78 (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < 0e62171df8ed4804d00db088f17eed06468233fa (git)
Affected: a3d43c0d56f1b94e74963a2fbadfb70126d92213 , < 105425b1969c5affe532713cfac1c0b320d7ac2b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_taprio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8fc396519ef4f081bc545e88f61241728bb78d7",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "3471874578160a28c171a607fa069f24062634b8",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "7256996e1ef553716817f3bfd077c2f3b48b582f",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "eee072fe16c646190d33ae69c9983d8de1562bf8",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "1bd286fa3e21200133478ed523cc6a2788baf38a",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "b73235da5dde77ed1264f9767b62c28c9d71fd78",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "0e62171df8ed4804d00db088f17eed06468233fa",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            },
            {
              "lessThan": "105425b1969c5affe532713cfac1c0b320d7ac2b",
              "status": "affected",
              "version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_taprio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is called to promote the admin schedule to oper.\nswitch_schedules() queues the old oper schedule for RCU freeing via\ncall_rcu(), but \u0027next\u0027 still points into an entry of the old oper\nschedule. The subsequent \u0027next-\u003eend_time = end_time\u0027 and\nrcu_assign_pointer(q-\u003ecurrent_entry, next) are use-after-free.\n\nFix this by selecting \u0027next\u0027 from the new oper schedule immediately\nafter switch_schedules(), and using its pre-calculated end_time.\nsetup_first_end_time() sets the first entry\u0027s end_time to\nbase_time + interval when the schedule is installed, so the value\nis already correct.\n\nThe deleted \u0027end_time = sched_base_time(admin)\u0027 assignment was also\nharmful independently: it would overwrite the new first entry\u0027s\npre-calculated end_time with just base_time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable taprio schedule switch is reached through local `NETLINK_ROUTE`/tc qdisc configuration, not by unauthenticated network packets. An attacker sends `RTM_NEWQDISC` messages to install and later switch taprio schedules.\nAC:L - The trigger is deterministic once the attacker installs an oper schedule and a later admin schedule with chosen base times/intervals. The attacker controls the schedule timing, so no condition beyond attacker control is required.\nPR:L - The rtnetlink qdisc path requires `CAP_NET_ADMIN` in the target network namespace. Because tc/qdisc configuration is reachable with namespaced `CAP_NET_ADMIN` via user namespaces in reasonable deployments, this is low privilege rather than high privilege.\nUI:N - No victim action is required after the attacker can issue the local netlink configuration. The hrtimer-driven schedule transition occurs automatically.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - This is a use-after-free of taprio schedule entry memory that leaves `current_entry` pointing into freed objects. As a kernel UAF, it can plausibly be shaped into memory disclosure primitives.\nI:H - The stale schedule entry is later written and used by scheduler/dequeue paths, giving attacker-influenced heap corruption potential. Under the required kernel guidance, a UAF is high integrity impact because it can be leveraged for arbitrary write or control-flow compromise.\nA:H - The dangling schedule entry can be dereferenced after RCU freeing by the timer or dequeue path. Even without full exploitation, this can cause kernel oops, panic, or repeated crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:38.643Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b"
        }
      ],
      "title": "net/sched: taprio: fix use-after-free in advance_sched() on schedule switch",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53011",
    "datePublished": "2026-06-24T16:29:22.082Z",
    "dateReserved": "2026-06-09T07:44:35.378Z",
    "dateUpdated": "2026-08-05T12:32:38.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53011",
      "date": "2026-09-16",
      "epss": "0.00126",
      "percentile": "0.02591"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:39:39.000Z",
      "cve": "CVE-2026-53011",
      "id": "msrc_CVE-2026-53011",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: taprio: fix use-after-free in advance_sched() on schedule switch",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53011.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53011\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:12.310\",\"lastModified\":\"2026-07-14T18:24:16.780\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\\n\\nIn advance_sched(), when should_change_schedules() returns true,\\nswitch_schedules() is called to promote the admin schedule to oper.\\nswitch_schedules() queues the old oper schedule for RCU freeing via\\ncall_rcu(), but \u0027next\u0027 still points into an entry of the old oper\\nschedule. The subsequent \u0027next-\u003eend_time = end_time\u0027 and\\nrcu_assign_pointer(q-\u003ecurrent_entry, next) are use-after-free.\\n\\nFix this by selecting \u0027next\u0027 from the new oper schedule immediately\\nafter switch_schedules(), and using its pre-calculated end_time.\\nsetup_first_end_time() sets the first entry\u0027s end_time to\\nbase_time + interval when the schedule is installed, so the value\\nis already correct.\\n\\nThe deleted \u0027end_time = sched_base_time(admin)\u0027 assignment was also\\nharmful independently: it would overwrite the new first entry\u0027s\\npre-calculated end_time with just base_time.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_taprio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"a8fc396519ef4f081bc545e88f61241728bb78d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"3471874578160a28c171a607fa069f24062634b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"7256996e1ef553716817f3bfd077c2f3b48b582f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"eee072fe16c646190d33ae69c9983d8de1562bf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"1bd286fa3e21200133478ed523cc6a2788baf38a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"b73235da5dde77ed1264f9767b62c28c9d71fd78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"0e62171df8ed4804d00db088f17eed06468233fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\"lessThan\":\"105425b1969c5affe532713cfac1c0b320d7ac2b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_taprio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"5.10.258\",\"matchCriteriaId\":\"0F7D399E-F4A0-4881-9225-0084E44B6BE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"919C10A9-7951-4A74-BADD-C135A0A8D8B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:11+00:00",
      "cve": "CVE-2026-53011",
      "id": "CVE-2026-53011",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53011.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T16:59:31Z",
      "cve": "CVE-2026-53011",
      "id": "CVE-2026-53011",
      "initial_release_date": "2026-06-26T02:13:35Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "607",
      "product_status:known_not_affected": "125",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53011",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53011.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.