CVE-2026-53275 (GCVE-0-2026-53275)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
ipv6: mcast: Fix use-after-free when processing MLD queries
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK> [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 1354271c89d0e5fbf8b3d94097ff0216695209c7 (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 53baa63a4183291574483f89583dbef13677a2c4 (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 2a613bf497029d555a7428406aa8cdb84a503cea (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < b2eb8886200b907fc71806869620609f0f4cacb0 (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 4203806f700bb44ea0b05d484d9d40044b47fb04 (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 087dbacf897c020f438f780f0a4a8aa73b6d7c5a (git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.15
Unaffected: 0 , < 2.6.15 (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1354271c89d0e5fbf8b3d94097ff0216695209c7",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "53baa63a4183291574483f89583dbef13677a2c4",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "2a613bf497029d555a7428406aa8cdb84a503cea",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "b2eb8886200b907fc71806869620609f0f4cacb0",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "4203806f700bb44ea0b05d484d9d40044b47fb04",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "087dbacf897c020f438f780f0a4a8aa73b6d7c5a",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "791c91dc7a9dfb2457d5e29b8216a6484b9c4b40",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\u003c/TASK\u003e\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable MLD query handler is reached by received ICMPv6 MLD Query packets, but the code requires a link-local IPv6 source, Hop Limit 1, and the MLD Router Alert option, making the highest defensible reachability an adjacent same-link attacker.\nAC:L - The attacker controls the packet contents, MLDv2 source count, and packet layout needed to trigger the stale skb-header pointer after pskb_may_pull(); there is no victim-controlled race or authentication-dependent state.\nPR:N - No local privileges or authentication are required; any adjacent network peer able to send crafted IPv6 MLD queries to the host can reach igmp6_event_query() and the queued mld_query_work path.\nUI:N - Exploitation is triggered by packet reception and asynchronous kernel workqueue processing without any required victim user action.\nS:U - The bug is in the host kernel IPv6 multicast listener processing and impacts the same kernel security authority, with no VM, IOMMU, or separate-scope boundary crossed.\nC:H - This is a use-after-free in kernel networking code; under the required conservative kernel guidance, UAFs are treated as capable of enabling high-impact information disclosure.\nI:H - Although the immediate stale access is a freed-memory read used in address comparison, it is still a kernel UAF and must be scored conservatively as potentially exploitable for memory corruption/control-flow impact.\nA:H - The commit includes a KASAN-confirmed slab-use-after-free in __mld_query_work(), and kernel UAFs can cause oops/panic or repeated denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:51.568Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04"
        },
        {
          "url": "https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40"
        }
      ],
      "title": "ipv6: mcast: Fix use-after-free when processing MLD queries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53275",
    "datePublished": "2026-06-25T08:39:59.115Z",
    "dateReserved": "2026-06-09T07:44:35.395Z",
    "dateUpdated": "2026-08-05T12:34:51.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53275",
      "date": "2026-08-07",
      "epss": "0.00232",
      "percentile": "0.14078"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T02:03:47.000Z",
      "cve": "CVE-2026-53275",
      "id": "msrc_CVE-2026-53275",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipv6: mcast: Fix use-after-free when processing MLD queries",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53275.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53275\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:45.687\",\"lastModified\":\"2026-07-08T04:00:32.483\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: mcast: Fix use-after-free when processing MLD queries\\n\\nWhen processing an MLD query, a pointer to the multicast group address\\nis retrieved when initially parsing the packet. This pointer is later\\ndereferenced without being reloaded despite the fact that the skb header\\nmight have been reallocated following the pskb_may_pull() calls, leading\\nto a use-after-free [1].\\n\\nFix by copying the multicast group address when the packet is initially\\nparsed.\\n\\n[1]\\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\\n\\nWorkqueue: mld mld_query_work\\nCall Trace:\\n\u003cTASK\u003e\\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\\nprint_report (mm/kasan/report.c:482)\\nkasan_report (mm/kasan/report.c:595)\\n__mld_query_work (net/ipv6/mcast.c:1512)\\nmld_query_work (net/ipv6/mcast.c:1563)\\nprocess_one_work (kernel/workqueue.c:3314)\\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\\nkthread (kernel/kthread.c:436)\\nret_from_fork (arch/x86/kernel/process.c:158)\\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\\n\u003c/TASK\u003e\\n\\n[...]\\n\\nFreed by task 118:\\nkasan_save_stack (mm/kasan/common.c:57)\\nkasan_save_track (mm/kasan/common.c:78)\\nkasan_save_free_info (mm/kasan/generic.c:584)\\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\\npskb_expand_head (net/core/skbuff.c:2335)\\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\\nmld_query_work (net/ipv6/mcast.c:1563)\\nprocess_one_work (kernel/workqueue.c:3314)\\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\\nkthread (kernel/kthread.c:436)\\nret_from_fork (arch/x86/kernel/process.c:158)\\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/mcast.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"1354271c89d0e5fbf8b3d94097ff0216695209c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"53baa63a4183291574483f89583dbef13677a2c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"2a613bf497029d555a7428406aa8cdb84a503cea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"b2eb8886200b907fc71806869620609f0f4cacb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"4203806f700bb44ea0b05d484d9d40044b47fb04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"087dbacf897c020f438f780f0a4a8aa73b6d7c5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97300b5fdfe28c6edae926926f9467a27cf5889c\",\"lessThan\":\"791c91dc7a9dfb2457d5e29b8216a6484b9c4b40\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/mcast.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.15\",\"versionEndExcluding\":\"5.15.210\",\"matchCriteriaId\":\"54C46741-C002-4552-85A7-21134555854B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"C4446623-5F2B-4DD8-8666-9FAAC285A757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.143\",\"matchCriteriaId\":\"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.94\",\"matchCriteriaId\":\"85421C0C-ABDE-4357-971C-67F9087DE1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.36\",\"matchCriteriaId\":\"389025D2-958D-41BD-BD96-70ED1033A9F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:35:31+00:00",
      "cve": "CVE-2026-53275",
      "id": "CVE-2026-53275",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: mcast: Fix use-after-free when processing MLD queries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53275.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T23:34:56Z",
      "cve": "CVE-2026-53275",
      "id": "CVE-2026-53275",
      "initial_release_date": "2026-06-26T02:07:48Z",
      "product_status:known_affected": "295",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53275",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53275.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.