CVE-2026-53259 (GCVE-0-2026-53259)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
ipv6: anycast: insert aca into global hash under idev->lock
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node. In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window: CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL) ------------------------------ ------------------------------------ aca_alloc() refcnt 1 aca_get() refcnt 2 write_lock_bh(idev->lock) add aca to ac_list write_unlock_bh(idev->lock) write_lock_bh(idev->lock) pull aca off ac_list write_unlock_bh(idev->lock) ipv6_del_acaddr_hash(aca) hlist_del_init_rcu() is a no-op, aca is not in the hash yet aca_put() refcnt 2->1 ipv6_add_acaddr_hash(aca) aca now inserted into the hash aca_put() refcnt 1->0 call_rcu(aca_free_rcu) -> kfree(aca) The hash removal becomes a no-op because the insertion has not happened yet, so once CPU0 inserts and drops the last reference, the aca is freed while still linked in inet6_acaddr_lst[], and readers dereference freed memory after the slab slot is reused. This window opened once RTNL stopped serializing the join path against device teardown. Move ipv6_add_acaddr_hash() inside the idev->lock section so the ac_list and hash insertions are atomic with respect to teardown: a racing remover now either misses the aca entirely or finds it in both lists. acaddr_hash_lock is now nested under idev->lock, which is acquired in softirq context, so switch all acaddr_hash_lock sites to spin_lock_bh() to avoid the irq lock inversion reported in [2]. [1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a [2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: eb1ac9ff6c4a5720b1a1476233be374c5dc44bff , < 15be7e9fdbff831fb3e89b83cc337a4f85ad3310 (git)
Affected: eb1ac9ff6c4a5720b1a1476233be374c5dc44bff , < 3a967c498baa976b11d4800dda224c507416e97c (git)
Affected: eb1ac9ff6c4a5720b1a1476233be374c5dc44bff , < f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3 (git)
Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/anycast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15be7e9fdbff831fb3e89b83cc337a4f85ad3310",
              "status": "affected",
              "version": "eb1ac9ff6c4a5720b1a1476233be374c5dc44bff",
              "versionType": "git"
            },
            {
              "lessThan": "3a967c498baa976b11d4800dda224c507416e97c",
              "status": "affected",
              "version": "eb1ac9ff6c4a5720b1a1476233be374c5dc44bff",
              "versionType": "git"
            },
            {
              "lessThan": "f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3",
              "status": "affected",
              "version": "eb1ac9ff6c4a5720b1a1476233be374c5dc44bff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/anycast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: anycast: insert aca into global hash under idev-\u003elock\n\nsyzbot reported a splat [1]: a slab-use-after-free in\nipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash\nunder RCU and dereferences a struct ifacaddr6 that has already been\nfreed while still linked in the hash, so a later reader walks into a\ndangling node.\n\nIn __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then\naca_get() bumps it to 2 to keep it alive across the unlocked region.\nIt is published to idev-\u003eac_list under idev-\u003elock, but\nipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent\nteardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL)\ncan slip into that window:\n\n  CPU0 __ipv6_dev_ac_inc           CPU1 ipv6_ac_destroy_dev (RTNL)\n  ------------------------------   ------------------------------------\n  aca_alloc()              refcnt 1\n  aca_get()               refcnt 2\n  write_lock_bh(idev-\u003elock)\n    add aca to ac_list\n  write_unlock_bh(idev-\u003elock)\n                                   write_lock_bh(idev-\u003elock)\n                                     pull aca off ac_list\n                                   write_unlock_bh(idev-\u003elock)\n                                   ipv6_del_acaddr_hash(aca)\n                                     hlist_del_init_rcu() is a no-op,\n                                     aca is not in the hash yet\n                                   aca_put()           refcnt 2-\u003e1\n  ipv6_add_acaddr_hash(aca)\n    aca now inserted into the hash\n  aca_put()                refcnt 1-\u003e0\n    call_rcu(aca_free_rcu) -\u003e kfree(aca)\n\nThe hash removal becomes a no-op because the insertion has not\nhappened yet, so once CPU0 inserts and drops the last reference, the\naca is freed while still linked in inet6_acaddr_lst[], and readers\ndereference freed memory after the slab slot is reused.\n\nThis window opened once RTNL stopped serializing the join path against\ndevice teardown. Move ipv6_add_acaddr_hash() inside the idev-\u003elock\nsection so the ac_list and hash insertions are atomic with respect to\nteardown: a racing remover now either misses the aca entirely or finds\nit in both lists.\n\nacaddr_hash_lock is now nested under idev-\u003elock, which is acquired in\nsoftirq context, so switch all acaddr_hash_lock sites to spin_lock_bh()\nto avoid the irq lock inversion reported in [2].\n\n[1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a\n[2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable anycast insertion path is reached through local IPv6 socket configuration such as setsockopt(IPV6_JOIN_ANYCAST), with teardown driven by local netdevice unregister/down paths. Remote packets can hit a later reader, but an attacker must first locally create the dangling anycast object.\nAC:L - The bug is a race between anycast join and device teardown, and a local attacker with net namespace control can drive both sides concurrently and retry. No rare external condition is required beyond winning an attacker-created race.\nPR:L - The join path checks CAP_NET_ADMIN in net-\u003euser_ns, which is reachable by an unprivileged user in a user/network namespace on systems permitting unprivileged user namespaces. It does not require real init-namespace root in the highest reasonable scenario.\nUI:N - Exploitation does not require a victim user to open a file, mount a filesystem, or perform any action. The attacker can invoke the socket option and teardown paths directly.\nS:U - The impact is within the kernel/network namespace security authority and does not cross a VM, IOMMU, or separate trust boundary. Kernel privilege escalation or kernel crash is scored as unchanged scope.\nC:H - This is a slab use-after-free where a freed ifacaddr6 remains linked in the global anycast hash and later readers dereference reused heap contents including pointers. Per kernel UAF guidance and the dangling global pointer primitive, high confidentiality impact is appropriate.\nI:H - A kernel use-after-free with attacker-influenced heap reuse can potentially be shaped into memory corruption or control-flow/data corruption primitives. When uncertain for UAF exploitability, the higher severity integrity impact is selected.\nA:H - syzbot reported a KASAN slab-use-after-free in ipv6_chk_acast_addr, and dereferencing the stale object can crash/oops the kernel. This is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:37.940Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15be7e9fdbff831fb3e89b83cc337a4f85ad3310"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a967c498baa976b11d4800dda224c507416e97c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3"
        }
      ],
      "title": "ipv6: anycast: insert aca into global hash under idev-\u003elock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53259",
    "datePublished": "2026-06-25T08:39:48.571Z",
    "dateReserved": "2026-06-09T07:44:35.394Z",
    "dateUpdated": "2026-08-05T12:34:37.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53259",
      "date": "2026-08-07",
      "epss": "0.00115",
      "percentile": "0.01814"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53259\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:43.893\",\"lastModified\":\"2026-07-08T16:39:16.290\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: anycast: insert aca into global hash under idev-\u003elock\\n\\nsyzbot reported a splat [1]: a slab-use-after-free in\\nipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash\\nunder RCU and dereferences a struct ifacaddr6 that has already been\\nfreed while still linked in the hash, so a later reader walks into a\\ndangling node.\\n\\nIn __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then\\naca_get() bumps it to 2 to keep it alive across the unlocked region.\\nIt is published to idev-\u003eac_list under idev-\u003elock, but\\nipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent\\nteardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL)\\ncan slip into that window:\\n\\n  CPU0 __ipv6_dev_ac_inc           CPU1 ipv6_ac_destroy_dev (RTNL)\\n  ------------------------------   ------------------------------------\\n  aca_alloc()              refcnt 1\\n  aca_get()               refcnt 2\\n  write_lock_bh(idev-\u003elock)\\n    add aca to ac_list\\n  write_unlock_bh(idev-\u003elock)\\n                                   write_lock_bh(idev-\u003elock)\\n                                     pull aca off ac_list\\n                                   write_unlock_bh(idev-\u003elock)\\n                                   ipv6_del_acaddr_hash(aca)\\n                                     hlist_del_init_rcu() is a no-op,\\n                                     aca is not in the hash yet\\n                                   aca_put()           refcnt 2-\u003e1\\n  ipv6_add_acaddr_hash(aca)\\n    aca now inserted into the hash\\n  aca_put()                refcnt 1-\u003e0\\n    call_rcu(aca_free_rcu) -\u003e kfree(aca)\\n\\nThe hash removal becomes a no-op because the insertion has not\\nhappened yet, so once CPU0 inserts and drops the last reference, the\\naca is freed while still linked in inet6_acaddr_lst[], and readers\\ndereference freed memory after the slab slot is reused.\\n\\nThis window opened once RTNL stopped serializing the join path against\\ndevice teardown. Move ipv6_add_acaddr_hash() inside the idev-\u003elock\\nsection so the ac_list and hash insertions are atomic with respect to\\nteardown: a racing remover now either misses the aca entirely or finds\\nit in both lists.\\n\\nacaddr_hash_lock is now nested under idev-\u003elock, which is acquired in\\nsoftirq context, so switch all acaddr_hash_lock sites to spin_lock_bh()\\nto avoid the irq lock inversion reported in [2].\\n\\n[1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a\\n[2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/anycast.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eb1ac9ff6c4a5720b1a1476233be374c5dc44bff\",\"lessThan\":\"15be7e9fdbff831fb3e89b83cc337a4f85ad3310\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb1ac9ff6c4a5720b1a1476233be374c5dc44bff\",\"lessThan\":\"3a967c498baa976b11d4800dda224c507416e97c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb1ac9ff6c4a5720b1a1476233be374c5dc44bff\",\"lessThan\":\"f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/anycast.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.17\",\"versionEndExcluding\":\"6.18.36\",\"matchCriteriaId\":\"43D90067-1014-46EC-861E-3BAF5F823B65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15be7e9fdbff831fb3e89b83cc337a4f85ad3310\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a967c498baa976b11d4800dda224c507416e97c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:32:48+00:00",
      "cve": "CVE-2026-53259",
      "id": "CVE-2026-53259",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: anycast: insert aca into global hash under idev-\u003elock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53259.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:13:42Z",
      "cve": "CVE-2026-53259",
      "id": "CVE-2026-53259",
      "initial_release_date": "2026-06-26T02:08:20Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53259",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53259.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.