Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53240— xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 6.14版本存在安全漏洞，该漏洞源于xfrm iptfs的__input_process_payload函数中存在释放后重用问题，可能导致攻击者操作已释放skb。

CVSS 8.8 · High EPSS 0.39% · P31

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 3f3339885fb343b7b42d7c34717108ce07da24ae< 8d9a79fbf5172d9c4c0146057af2360913265a11 affected
3f3339885fb343b7b42d7c34717108ce07da24ae< ff2ee35b6ce5fa8a8e24ea50b15733d5c8780198 affected
3f3339885fb343b7b42d7c34717108ce07da24ae< eb48730bb827d1550401a5d391903f9d90b493c8 affected
6.14 affected
< 6.14 unaffected
6.18.36≤ 6.18.* unaffected
7.0.13≤ 7.0.* unaffected
7.1≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53240

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is still owned: if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb) Between spin_unlock and this read, a concurrent CPU running iptfs_reassem_cont() (or the drop_timer hrtimer) can complete reassembly, NULL xtfs->ra_newskb, and free the skb. The check then evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb operate on the freed skb — a use-after-free in skbuff_head_cache. Replace the unlocked read with a local bool that records whether first_skb was handed to the reassembly state in the current call. The flag is set after the existing spin_unlock, before the break, using the pointer equality that is stable at that point (first_skb == skb iff first_skb was stored in ra_newskb).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 6.14版本存在安全漏洞，该漏洞源于xfrm iptfs的__input_process_payload函数中存在释放后重用问题，可能导致攻击者操作已释放skb。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3f3339885fb343b7b42d7c34717108ce07da24ae ~ 8d9a79fbf5172d9c4c0146057af2360913265a11 -
Linux Linux 6.14 -

II. Public POCs for CVE-2026-53240

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53240

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53240 (3)

Same Patch Batch · Linux · 2026-06-25 · 146 CVEs total

CVE-2026-53175 9.8 CRITICAL inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
CVE-2026-53176 9.8 CRITICAL IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
CVE-2026-53228 9.8 CRITICAL ipv6: sit: reload inner IPv6 header after GSO offloads
CVE-2026-53221 9.8 CRITICAL ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
CVE-2026-53246 9.8 CRITICAL sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
CVE-2026-53247 9.8 CRITICAL net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
CVE-2026-53151 9.8 CRITICAL rxrpc: Fix the ACK parser to extract the SACK table for parsing
CVE-2026-53260 9.8 CRITICAL tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-53216 9.8 CRITICAL net: mvpp2: limit XDP frame size to the RX buffer
CVE-2026-53215 9.8 CRITICAL net: mvpp2: refill RX buffers before XDP or skb use
CVE-2026-53131 9.4 CRITICAL netfilter: require Ethernet MAC header before using eth_hdr()
CVE-2026-53225 9.1 CRITICAL sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
CVE-2026-53224 9.1 CRITICAL sctp: validate embedded INIT chunk and address list lengths in cookie
CVE-2026-53186 9.1 CRITICAL RDMA/srp: bound SRP_RSP sense copy by the received length
CVE-2026-53248 8.8 HIGH net: airoha: Fix use-after-free in metadata dst teardown
CVE-2026-53198 8.8 HIGH ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
CVE-2026-53159 8.8 HIGH misc: fastrpc: fix DMA address corruption due to find_vma misuse
CVE-2026-53275 8.8 HIGH ipv6: mcast: Fix use-after-free when processing MLD queries
CVE-2026-53188 8.8 HIGH RDMA/core: Validate the passed in fops for ib_get_ucaps()
CVE-2026-53171 8.8 HIGH accel/ethosu: fix arithmetic issues in dma_length()

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53240

No comments yet

Leave a comment