Log in / Sign up

Vulnerability details

CVE-2026-53239

Linux LinuxSiemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFPSiemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPSiemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystemSiemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

CVSS 3.1
7.8High

Official description

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed

CVSS scores

ScoreVersionSourceVector
7.8High 3.1 CVEProject cvelistV5 (CNA) (Linux) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Linux Linux 5.0 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < 25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < 42827d03f8009a6a218bacab153e21f39d6a121c CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < 88697cf980222d5906a37bf47662dac0732e2a0f CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < b5316e2b8614a87d8736941972441cb47bfd4491 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < ec82ea4eb220164d854f8734ca5a35e23e577b94 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < 7f2d76c9c03257c0782afef9d95321fa04096f60 CVEProject cvelistV5 (CNA)
Linux Linux 6be3b0db6db82cf056a72cc18042048edd27f8ee ≤ v < 8fc536e9f6856230f19c7d13e71af064b6a77b22 CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.7 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.7 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.7 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.7 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All CVEProject cvelistV5 (CNA)
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 ≤ v CVEProject cvelistV5 (CNA)
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.7 ≤ v CVEProject cvelistV5 (CNA)

References and advisories

11
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-06-25
Last updated
2026-10-19
State
Published
Assigner (CNA)
Linux

Exploit prediction (EPSS)

0.1%
Probability of exploitation in 30 days
0.9%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-362
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')