CVE-2026-53157
published 2026-06-25CVE-2026-53157: In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: phonet: free phonet_device after RCU grace period
phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.
Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < d59794337ea496042288c7c68356d9b9ca7f46a9 | d59794337ea496042288c7c68356d9b9ca7f46a9 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < 6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 | 6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < 2ec8011cce0cd0fc7a5068585d867fc08d508578 | 2ec8011cce0cd0fc7a5068585d867fc08d508578 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < 09c9b92c2010481160245244ea8fa1d06d5d4ae0 | 09c9b92c2010481160245244ea8fa1d06d5d4ae0 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < bd2ab4d800fc26814d89328d87b5f97ef6aa906a | bd2ab4d800fc26814d89328d87b5f97ef6aa906a |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < 52b8f5ef82c886f7cd24617915e4b1579ddfd001 | 52b8f5ef82c886f7cd24617915e4b1579ddfd001 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < bff309ea51f1395c1ef8be8b75ce62d28a319113 | bff309ea51f1395c1ef8be8b75ce62d28a319113 |
| linux | linux | >= eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 < 71de0177b28da751f407581a4515cf4d762f6296 | 71de0177b28da751f407581a4515cf4d762f6296 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.33 < 5.10.260 | 5.10.260 |
| linux | linux_kernel | >= 5.11 < 5.15.211 | 5.15.211 |
| linux | linux_kernel | >= 5.16 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.35/7.0.12 net phonet_device_destroy use after free (Nessus ID 323589 / WID-SEC-2026-2077)
vuldb·2026-06-29
CVE-2026-53157 [CRITICAL] Linux Kernel up to 6.18.35/7.0.12 net phonet_device_destroy use after free (Nessus ID 323589 / WID-SEC-2026-2077)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.35/7.0.12. This affects the function phonet_device_destroy of the component net. Executing a manipulation can lead to use after free.
This vulnerability appears as CVE-2026-53157. The attacker needs to be present on the local network. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device lis
ghsa_unreviewed·2026-06-25
CVE-2026-53157 In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device lis
In the Linux kernel, the following vulnerability has been resolved:
net: phonet: free phonet_device after RCU grace period
phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.
Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.
Red Hat
kernel: net: phonet: free phonet_device after RCU grace period
vendor_redhat·2026-06-25·CVSS 7.0
CVE-2026-53157 [MEDIUM] CWE-825 kernel: net: phonet: free phonet_device after RCU grace period
kernel: net: phonet: free phonet_device after RCU grace period
In the Linux kernel, the following vulnerability has been resolved:
net: phonet: free phonet_device after RCU grace period
phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.
Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.
A flaw was found in the Linux kernel's phonet networking subsystem. This vulnerability occurs because a phonet device is freed immediately after being removed from a list, while other parts of the kernel (RCU readers) may still hold a pointer to t
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906ahttps://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9
2026-06-25
Published