Skip to content
Heist/ feed
Back to feed
CriticalFix available

inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the n

Products
Kernel
Affected versions
Not specified
Fixed versions
6.12.94, 6.18.36, 7.0.13
CVEs
CVE-2026-53175
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 11:12 UTC · Revision 1

Source evidence

inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

core-osv · Original source

Published 25 Jun 2026, 08:38 UTC

In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the n

osv:CVE-2026-53175

Kernel

Fixed versions: 6.12.94, 6.18.36, 7.0.13

Complete source record
{
  "id": "4789abb6c93d2fc59680ab24061713bfa4373ad73fab860a7f0b6ed872b18591",
  "url": "https://osv.dev/vulnerability/CVE-2026-53175",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the n",
    "evidence": "osv:CVE-2026-53175",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.12.94",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.36",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.13",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-53175",
      "aliases": [
        "CVE-2026-53175"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "22ee4010866da81aeee08e1ea3fddbe418feb212"
                },
                {
                  "fixed": "0e823ca0e7391630784ae7dd0981b7ad170a93d9"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "543555954b1ee8d1903a7020324efb41b0c97428"
                },
                {
                  "fixed": "c22599cc90e1cd5f8129c8670bd68a02ff7177b4"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c70df25214ac9b32b53e18e6ae3b8f073ffa6903"
                },
                {
                  "fixed": "89b909e9704587bfecc1aab1d37e98faee03b9f9"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "006a5035b495dec008805df249f92c22c89c3d2e"
                },
                {
                  "fixed": "010c3313a4d178dc2d3ce958d2e5cb055e2864c1"
                },
                {
                  "fixed": "32594b09854970d7ba83eb2dc8c69a2edd158c8e"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.12.93"
                },
                {
                  "fixed": "6.12.94"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.18.3"
                },
                {
                  "fixed": "6.18.36"
                }
              ]
            }
          ],
          "versions": [
            "v6.12.93",
            "v6.18.35",
            "v6.18.34",
            "v6.18.33",
            "v6.18.32",
            "v6.18.31",
            "v6.18.30",
            "v6.18.29",
            "v6.18.28",
            "v6.18.27",
            "v6.18.26",
            "v6.18.25",
            "v6.18.24",
            "v6.18.23",
            "v6.18.22",
            "v6.18.21",
            "v6.18.20",
            "v6.18.19",
            "v6.18.18",
            "v6.18.17",
            "v6.18.16",
            "v6.18.15",
            "v6.18.14",
            "v6.18.13",
            "v6.18.12",
            "v6.18.11",
            "v6.18.10",
            "v6.18.9",
            "v6.18.8",
            "v6.18.7",
            "v6.18.6",
            "v6.18.5",
            "v6.18.4",
            "v6.18.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53175.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.12.94"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.36"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.13"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53175.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:43.795638033Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1",
        "https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9",
        "https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e",
        "https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9",
        "https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53175.json",
        "https://access.redhat.com/security/cve/CVE-2026-53175",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53175.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53175",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2492840",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53175.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53175",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 511705,
  "published_at": "2026-06-25T08:38:52.034+00:00"
}