Vulnerability-Lookup

CNVD-2026-25961

Vulnerability from cnvd - Published: 2026-06-30

Title

Linux Kernel内存错误引用漏洞（CNVD-2026-25961）

Description

Linux kernel是一个开源的操作系统内核，提供进程管理、内存管理、网络协议栈和硬件驱动等核心功能。 Linux kernel存在内存错误引用漏洞。该漏洞源于处理MLD查询时，初始解析数据包获取的多播组地址指针在后续解引用前未重新加载，而skb头部可能已被重新分配，攻击者可利用该漏洞造成内核内存破坏。

Severity

高

Patch Name

Linux Kernel内存错误引用漏洞（CNVD-2026-25961）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-53275

Impacted products

Name
Linux Kernel 2.6.15

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-53275",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-53275"
    }
  },
  "description": "Linux kernel\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\uff0c\u63d0\u4f9b\u8fdb\u7a0b\u7ba1\u7406\u3001\u5185\u5b58\u7ba1\u7406\u3001\u7f51\u7edc\u534f\u8bae\u6808\u548c\u786c\u4ef6\u9a71\u52a8\u7b49\u6838\u5fc3\u529f\u80fd\u3002\n\nLinux kernel\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5904\u7406MLD\u67e5\u8be2\u65f6\uff0c\u521d\u59cb\u89e3\u6790\u6570\u636e\u5305\u83b7\u53d6\u7684\u591a\u64ad\u7ec4\u5730\u5740\u6307\u9488\u5728\u540e\u7eed\u89e3\u5f15\u7528\u524d\u672a\u91cd\u65b0\u52a0\u8f7d\uff0c\u800cskb\u5934\u90e8\u53ef\u80fd\u5df2\u88ab\u91cd\u65b0\u5206\u914d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u6838\u5185\u5b58\u7834\u574f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-25961",
  "openTime": "2026-06-30",
  "patchDescription": "Linux kernel\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\uff0c\u63d0\u4f9b\u8fdb\u7a0b\u7ba1\u7406\u3001\u5185\u5b58\u7ba1\u7406\u3001\u7f51\u7edc\u534f\u8bae\u6808\u548c\u786c\u4ef6\u9a71\u52a8\u7b49\u6838\u5fc3\u529f\u80fd\u3002\r\n\r\nLinux kernel\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5904\u7406MLD\u67e5\u8be2\u65f6\uff0c\u521d\u59cb\u89e3\u6790\u6570\u636e\u5305\u83b7\u53d6\u7684\u591a\u64ad\u7ec4\u5730\u5740\u6307\u9488\u5728\u540e\u7eed\u89e3\u5f15\u7528\u524d\u672a\u91cd\u65b0\u52a0\u8f7d\uff0c\u800cskb\u5934\u90e8\u53ef\u80fd\u5df2\u88ab\u91cd\u65b0\u5206\u914d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u6838\u5185\u5b58\u7834\u574f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Linux Kernel\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2026-25961\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Linux Kernel 2.6.15"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-53275",
  "serverity": "\u9ad8",
  "submitTime": "2026-06-27",
  "title": "Linux Kernel\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2026-25961\uff09"
}

CVE-2026-53275 (GCVE-0-2026-53275)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50

Title

ipv6: mcast: Fix use-after-free when processing MLD queries

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK> [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

9 references

URL	Tags
https://git.kernel.org/stable/c/dfaf1f5e7eb81be87…
https://git.kernel.org/stable/c/1354271c89d0e5fbf…
https://git.kernel.org/stable/c/53baa63a418329157…
https://git.kernel.org/stable/c/2a613bf497029d555…
https://git.kernel.org/stable/c/b2eb8886200b907fc…
https://git.kernel.org/stable/c/4203806f700bb44ea…
https://git.kernel.org/stable/c/087dbacf897c020f4…
https://git.kernel.org/stable/c/791c91dc7a9dfb245…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 1354271c89d0e5fbf8b3d94097ff0216695209c7 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 53baa63a4183291574483f89583dbef13677a2c4 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 2a613bf497029d555a7428406aa8cdb84a503cea (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < b2eb8886200b907fc71806869620609f0f4cacb0 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 4203806f700bb44ea0b05d484d9d40044b47fb04 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 087dbacf897c020f438f780f0a4a8aa73b6d7c5a (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 (git)
Linux	Linux	Affected: 2.6.15 Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.269 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:50:14.669Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "1354271c89d0e5fbf8b3d94097ff0216695209c7",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "53baa63a4183291574483f89583dbef13677a2c4",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "2a613bf497029d555a7428406aa8cdb84a503cea",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "b2eb8886200b907fc71806869620609f0f4cacb0",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "4203806f700bb44ea0b05d484d9d40044b47fb04",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "087dbacf897c020f438f780f0a4a8aa73b6d7c5a",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            },
            {
              "lessThan": "791c91dc7a9dfb2457d5e29b8216a6484b9c4b40",
              "status": "affected",
              "version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\u003c/TASK\u003e\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable MLD query handler is reached by received ICMPv6 MLD Query packets, but the code requires a link-local IPv6 source, Hop Limit 1, and the MLD Router Alert option, making the highest defensible reachability an adjacent same-link attacker.\nAC:L - The attacker controls the packet contents, MLDv2 source count, and packet layout needed to trigger the stale skb-header pointer after pskb_may_pull(); there is no victim-controlled race or authentication-dependent state.\nPR:N - No local privileges or authentication are required; any adjacent network peer able to send crafted IPv6 MLD queries to the host can reach igmp6_event_query() and the queued mld_query_work path.\nUI:N - Exploitation is triggered by packet reception and asynchronous kernel workqueue processing without any required victim user action.\nS:U - The bug is in the host kernel IPv6 multicast listener processing and impacts the same kernel security authority, with no VM, IOMMU, or separate-scope boundary crossed.\nC:H - This is a use-after-free in kernel networking code; under the required conservative kernel guidance, UAFs are treated as capable of enabling high-impact information disclosure.\nI:H - Although the immediate stale access is a freed-memory read used in address comparison, it is still a kernel UAF and must be scored conservatively as potentially exploitable for memory corruption/control-flow impact.\nA:H - The commit includes a KASAN-confirmed slab-use-after-free in __mld_query_work(), and kernel UAFs can cause oops/panic or repeated denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:38.838Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea"
        },
        {
          "url": "https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04"
        },
        {
          "url": "https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40"
        }
      ],
      "title": "ipv6: mcast: Fix use-after-free when processing MLD queries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53275",
    "datePublished": "2026-06-25T08:39:59.115Z",
    "dateReserved": "2026-06-09T07:44:35.395Z",
    "dateUpdated": "2026-09-08T08:50:14.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-25961

CVE-2026-53275 (GCVE-0-2026-53275)

Tags

Sightings

Nomenclature

Related by attack behaviour