CVE-2026-53157
net: phonet: free phonet_device after RCU grace period
Description
In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 7, 2026, 6:54 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Apply the kernel patch for phonet device handling.
- Use kfree_rcu to free phonet_device after RCU grace period.
- Ensure RCU grace periods are respected for freed objects.
Public PoC/Exploit Available at Github
CVE-2026-53157 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53157.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53157 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53157
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53157 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53157 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.33 up to (excluding) 5.10.260 Added Reference Type kernel.org: https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0 Added Reference https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578 Added Reference https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763 Added Reference https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a Added Reference https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'd59794337ea496042288c7c68356d9b9ca7f46a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '2ec8011cce0cd0fc7a5068585d867fc08d508578', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '09c9b92c2010481160245244ea8fa1d06d5d4ae0', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bd2ab4d800fc26814d89328d87b5f97ef6aa906a', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '52b8f5ef82c886f7cd24617915e4b1579ddfd001', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': 'bff309ea51f1395c1ef8be8b75ce62d28a319113', 'versionType': 'git'}, {'status': 'affected', 'version': 'eeb74a9d45f781ec6f47b9e0a75a6a427b53f165', 'lessThan': '71de0177b28da751f407581a4515cf4d762f6296', 'versionType': 'git'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.33'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.33', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/phonet/pn_dev.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type. Added Reference https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001 Added Reference https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296 Added Reference https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113