{"id":"CVE-2026-53275","revision":"fcedf011319845e5bcd0961bfe9ca1e3","records":[{"revision":"fcedf011319845e5bcd0961bfe9ca1e3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53275","aliases":[],"title":"ipv6: mcast: Fix use-after-free when processing MLD queries","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n<TASK>\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n</TASK>\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)","state":0,"publishedAt":"2026-06-25T08:39:59.115+00:00","modifiedAt":"2026-10-19T19:57:33.329+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/mcast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"1354271c89d0e5fbf8b3d94097ff0216695209c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"53baa63a4183291574483f89583dbef13677a2c4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"2a613bf497029d555a7428406aa8cdb84a503cea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"b2eb8886200b907fc71806869620609f0f4cacb0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"4203806f700bb44ea0b05d484d9d40044b47fb04\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"087dbacf897c020f438f780f0a4a8aa73b6d7c5a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97300b5fdfe28c6edae926926f9467a27cf5889c\",\n                            \"lessThan\": \"791c91dc7a9dfb2457d5e29b8216a6484b9c4b40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/mcast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.269\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.94\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.36\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.13\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea","https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7","https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4","https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea","https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0","https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04","https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a","https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53275","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53275","identifiers":["CVE-2026-53275"]},"retained":false,"historicalAffected":[]}],"coverage":[]}