CVE-2026-53055: crypto: hisilicon/sec2 - prevent req used-after-free for sec
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/sec2 - prevent req used-after-free for sec
During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qpctx memory exists throughout the packet sending process, so replace the req with the qpctx.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Under heavy load, reduce or mitigate traffic/requests to lower the likelihood of triggering the use-after-free in the Linux kernel crypto hisilicon/sec2 path until the kernel fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53055?
CVE-2026-53055 has a critical severity score of 9.8.
What impact does CVE-2026-53055 have on Linux systems?
CVE-2026-53055 can lead to a use-after-free condition affecting packet transmission under heavy load.
How do I fix CVE-2026-53055?
To fix CVE-2026-53055, upgrade your Linux kernel to the patched version that addresses this vulnerability.
Which Linux kernel versions are affected by CVE-2026-53055?
CVE-2026-53055 affects the Linux kernel's crypto/hisilicon/sec2 component.
What mitigation strategies exist for CVE-2026-53055?
There are no specific mitigation strategies for CVE-2026-53055 other than applying the kernel update.