CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths
In the Linux kernel, the following vulnerability has been resolved:
nvmem: core: fix use-after-free bugs in error paths
Fix several instances of error paths in which we call nvmemdeviceput() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In __nvmem_device_put() error paths, ensure the nvmem device reference is released (put) as the final operation immediately before returning the error code, preventing use-after-free of the nvmem structure and underlying memory.
Linux kernel (nvmem core) __nvmem_device_put() error-path reference handling = Put the reference to the nvmem device as the last step before returning the error code
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53156?
CVE-2026-53156 has a risk score of 36, indicating a potential security concern in the Linux kernel.
How do I fix CVE-2026-53156?
To fix CVE-2026-53156, update your Linux kernel to the latest version that addresses the use-after-free bug.
What types of systems are affected by CVE-2026-53156?
CVE-2026-53156 affects Linux kernel implementations that utilize the nvmem core functionalities.
What is a use-after-free vulnerability?
A use-after-free vulnerability like CVE-2026-53156 occurs when a program continues to use memory after it has been freed, potentially leading to system instability or security breaches.
When was CVE-2026-53156 published?
CVE-2026-53156 was published on June 25, 2026.