7.8
HIGH CVSS 3.1
CVE-2026-53157
net: phonet: free phonet_device after RCU grace period
Description

In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.

INFO

Published Date :

June 25, 2026, 9:16 a.m.

Last Modified :

July 7, 2026, 6:54 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-53157 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH [email protected]
Solution
Use kfree_rcu for deferred freeing of phonet_device objects.
  • Apply the kernel patch for phonet device handling.
  • Use kfree_rcu to free phonet_device after RCU grace period.
  • Ensure RCU grace periods are respected for freed objects.
Public PoC/Exploit Available at Github

CVE-2026-53157 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53157 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53157 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

DSA and DLA for Debian last 14 days

Python

Updated: 2 days, 6 hours ago
2 stars 1 fork 1 watcher
Born at : Feb. 12, 2025, 2:08 p.m. This repo has been linked 584 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53157 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-53157 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jul. 07, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-416
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.33 up to (excluding) 5.10.260
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9 Types: Patch
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 04, 2026

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0
    Added Reference https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578
    Added Reference https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763
    Added Reference https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a
    Added Reference https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'd59794337ea496042288c7c68356d9b9ca7f46a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '2ec8011cce0cd0fc7a5068585d867fc08d508578', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '09c9b92c2010481160245244ea8fa1d06d5d4ae0', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bd2ab4d800fc26814d89328d87b5f97ef6aa906a', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 25, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.
    Added Reference https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001
    Added Reference https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296
    Added Reference https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.