CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.11-1 - Compensating control
In the Linux kernel, update inet_frag_queue_flush() to reset rb_fragments, fragments_tail, and last_run_head so a flushed fragment queue no longer points to freed skbs; this applies to IPv4, IPv6, nf_conntrack_reasm6, and 6lowpan reassembly, which share the affected flush path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53175?
CVE-2026-53175 has a risk score of 47, indicating a moderate level of severity.
How do I fix CVE-2026-53175?
Fixing CVE-2026-53175 involves updating the Linux kernel to the latest patched version that addresses this use-after-free vulnerability.
What types of systems are affected by CVE-2026-53175?
CVE-2026-53175 affects systems running certain versions of the Linux kernel that are utilizing the inet fragment handling mechanism.
Can CVE-2026-53175 be exploited remotely?
Yes, CVE-2026-53175 can potentially be exploited remotely if an attacker can manipulate network traffic to trigger the vulnerability.
What is the primary cause of CVE-2026-53175?
The primary cause of CVE-2026-53175 is a use-after-free error related to the fqdir_pre_exit() function during network namespace teardown.