CVE-2026-53055
published 2026-06-24CVE-2026-53055: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
35.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/sec2 - prevent req used-after-free for sec
During packet transmission, if the system is under heavy load,
the hardware might complete processing the packet and free the
request memory (req) before the transmission function finishes.
If the software subsequently accesses this req, a use-after-free
error will occur. The qp_ctx memory exists throughout the packet
sending process, so replace the req with the qp_ctx.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= f0ae287c50455f7be0d8dd45a803d403c7aa4d2e < b375c3c7209cc59e40e97998aa9bc768369cca0e | b375c3c7209cc59e40e97998aa9bc768369cca0e |
| linux | linux | >= f0ae287c50455f7be0d8dd45a803d403c7aa4d2e < ad73563f3a1edbfddf2724136c6a15826b354e18 | ad73563f3a1edbfddf2724136c6a15826b354e18 |
| linux | linux | >= f0ae287c50455f7be0d8dd45a803d403c7aa4d2e < 67b53a660e6bf0da2fa8d8872e897a14d8059eaf | 67b53a660e6bf0da2fa8d8872e897a14d8059eaf |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the ha
ghsa_unreviewed·2026-06-24
CVE-2026-53055 In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the ha
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/sec2 - prevent req used-after-free for sec
During packet transmission, if the system is under heavy load,
the hardware might complete processing the packet and free the
request memory (req) before the transmission function finishes.
If the software subsequently accesses this req, a use-after-free
error will occur. The qp_ctx memory exists throughout the packet
sending process, so replace the req with the qp_ctx.
VulDB
Linux Kernel up to 6.18.32/7.0.9 crypto transmission use after free
vuldb·2026-06-24
CVE-2026-53055 [CRITICAL] Linux Kernel up to 6.18.32/7.0.9 crypto transmission use after free
A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.32/7.0.9. This issue affects the function transmission of the component crypto. Executing a manipulation can lead to use after free.
This vulnerability is tracked as CVE-2026-53055. The attack is only possible within the local network. No exploit exists.
The affected component should be upgraded.
Red Hat
kernel: crypto: hisilicon/sec2 - prevent req used-after-free for sec
vendor_redhat·2026-06-24
CVE-2026-53055 CWE-825 kernel: crypto: hisilicon/sec2 - prevent req used-after-free for sec
kernel: crypto: hisilicon/sec2 - prevent req used-after-free for sec
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/sec2 - prevent req used-after-free for sec
During packet transmission, if the system is under heavy load,
the hardware might complete processing the packet and free the
request memory (req) before the transmission function finishes.
If the software subsequently accesses this req, a use-after-free
error will occur. The qp_ctx memory exists throughout the packet
sending process, so replace the req with the qp_ctx.
A flaw was found in the Linux kernel's `hisilicon/sec2` cryptographic module. Under heavy system load during packet transmission, the hardware may free request memory before the software completes its processing. This can lead
No detection rules found.
No public exploits indexed.
2026-06-24
Published