CVE-2026-53055

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/67b53a660e6bf0da2fa8d8872e897a14d8059eaf	Patch
https://git.kernel.org/stable/c/ad73563f3a1edbfddf2724136c6a15826b354e18	Patch
https://git.kernel.org/stable/c/b375c3c7209cc59e40e97998aa9bc768369cca0e	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: crypto: hisilicon/sec2 - prevenir uso después de liberación de req para sec Durante la transmisión de paquetes, si el sistema está bajo carga pesada, el hardware podría completar el procesamiento del paquete y liberar la memoria de la solicitud (req) antes de que la función de transmisión finalice. Si el software accede posteriormente a este req, ocurrirá un error de uso después de liberación. La memoria qp_ctx existe durante todo el proceso de envío de paquetes, así que reemplace el req con el qp_ctx.

Information

Published : 2026-06-24 17:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-53055

Mitre link : CVE-2026-53055

CVE.ORG link : CVE-2026-53055

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2026-53055", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f0ae287c50455f7be0d8dd45a803d403c7aa4d2e", "lessThan": "b375c3c7209cc59e40e97998aa9bc768369cca0e", "versionType": "git"}, {"status": "affected", "version": "f0ae287c50455f7be0d8dd45a803d403c7aa4d2e", "lessThan": "ad73563f3a1edbfddf2724136c6a15826b354e18", "versionType": "git"}, {"status": "affected", "version": "f0ae287c50455f7be0d8dd45a803d403c7aa4d2e", "lessThan": "67b53a660e6bf0da2fa8d8872e897a14d8059eaf", "versionType": "git"}], "programFiles": ["drivers/crypto/hisilicon/sec2/sec_crypto.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/hisilicon/sec2/sec_crypto.c"], "defaultStatus": "affected"}]}], "published": "2026-06-24T17:17:17.527", "references": [{"url": "https://git.kernel.org/stable/c/67b53a660e6bf0da2fa8d8872e897a14d8059eaf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ad73563f3a1edbfddf2724136c6a15826b354e18", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b375c3c7209cc59e40e97998aa9bc768369cca0e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec2 - prevent req used-after-free for sec\n\nDuring packet transmission, if the system is under heavy load,\nthe hardware might complete processing the packet and free the\nrequest memory (req) before the transmission function finishes.\nIf the software subsequently accesses this req, a use-after-free\nerror will occur. The qp_ctx memory exists throughout the packet\nsending process, so replace the req with the qp_ctx."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: hisilicon/sec2 - prevenir uso despu\u00e9s de liberaci\u00f3n de req para sec\n\nDurante la transmisi\u00f3n de paquetes, si el sistema est\u00e1 bajo carga pesada,\nel hardware podr\u00eda completar el procesamiento del paquete y liberar la\nmemoria de la solicitud (req) antes de que la funci\u00f3n de transmisi\u00f3n finalice.\nSi el software accede posteriormente a este req, ocurrir\u00e1 un error de uso despu\u00e9s de liberaci\u00f3n.\nLa memoria qp_ctx existe durante todo el proceso de env\u00edo de paquetes, as\u00ed que reemplace el req con el qp_ctx."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F0E1027-1081-4E2B-9D56-AF79BAFF146B", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}