CVE-2026-53055: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53055 Overview

CVE-2026-53055 is a use-after-free vulnerability in the Linux kernel's hisilicon/sec2 crypto driver. The flaw occurs during packet transmission in the Hisilicon SEC2 cryptographic accelerator code path. Under heavy system load, the hardware can complete packet processing and free the request memory (req) before the transmission function finishes. Any subsequent software access to the freed req structure triggers a use-after-free condition. The upstream fix replaces the req reference with the longer-lived qp_ctx memory, which persists throughout the packet-sending process.

Critical Impact
Use-after-free in the kernel crypto subsystem can lead to memory corruption, kernel panic, or potential privilege escalation on systems using Hisilicon SEC2 accelerators under load.

Affected Products

Linux kernel versions containing the hisilicon/sec2 crypto driver prior to the fix commits
Systems using Hisilicon SEC2 cryptographic accelerator hardware
Distributions shipping the affected stable kernel branches

Discovery Timeline

2026-06-24 - CVE-2026-53055 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53055

Vulnerability Analysis

The vulnerability resides in the Hisilicon SEC2 (Security Engine v2) crypto driver, located under drivers/crypto/hisilicon/sec2/ in the Linux kernel source tree. The driver submits cryptographic requests to dedicated accelerator hardware through queue pairs. Each request is tracked by a req structure that holds context for an in-flight cryptographic operation.

During packet transmission, the driver hands the request to the hardware and then continues post-submission bookkeeping. Under heavy load, the hardware can complete the request and invoke the completion handler before the submitting function returns. The completion handler frees the req memory. The submitting code then dereferences the now-freed pointer, producing a use-after-free.

This is a classic race condition between request submission and asynchronous hardware completion. It does not require an attacker-controlled crypto payload to trigger — sustained crypto workload pressure is sufficient to reproduce the window.

Root Cause

The root cause is improper lifetime management of the req object across the asynchronous boundary between software submission and hardware completion. The submission path assumed req remained valid until it returned, but the hardware-driven completion path can free it earlier. The fix removes the dependency on req after submission by using the queue pair context (qp_ctx), which has a lifetime spanning the entire send operation.

Attack Vector

Triggering the race requires local code paths that generate sufficient crypto workload through the SEC2 accelerator to keep the hardware completion pipeline saturated. The vulnerability manifests as kernel memory corruption rather than a remote attack surface. Exploitability for privilege escalation depends on the kernel allocator state and whether freed req slabs can be reclaimed with attacker-controlled content before the dereference. EPSS scoring places real-world exploitation likelihood low at the time of publication.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the upstream commits referenced in the Kernel Git Commit Log.

Detection Methods for CVE-2026-53055

Indicators of Compromise

Kernel oops or panic messages referencing hisilicon/sec2, sec_main, or sec_crypto functions in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) use-after-free reports implicating the SEC2 driver call stack
Unexpected crashes on systems performing sustained crypto offload through Hisilicon SEC2 hardware

Detection Strategies

Inventory kernel versions across Linux fleets and identify hosts running unpatched stable branches with the hisilicon-sec2 module loaded (lsmod | grep hisi_sec2)
Enable KASAN on test or canary builds running SEC2 workloads to surface the race during validation
Monitor for repeated kernel crash signatures pointing to the SEC2 send/completion paths

Monitoring Recommendations

Forward kernel logs and crash reports to a centralized logging or SIEM platform for correlation across hosts
Alert on BUG: KASAN: use-after-free strings combined with sec2 module references
Track kernel package versions through configuration management to detect drift from patched baselines

How to Mitigate CVE-2026-53055

Immediate Actions Required

Apply the upstream kernel patches referenced in the advisory commits 67b53a66, ad73563f, and b375c3c7
Update to a stable kernel release that incorporates the hisilicon/sec2 use-after-free fix
Prioritize patching on systems with Hisilicon SEC2 accelerators handling production crypto workloads

Patch Information

The fix is committed upstream and backported to stable branches. See the patches at Kernel Git Commit 67b53a66, Kernel Git Commit ad73563f, and Kernel Git Commit b375c3c7. The patches replace the req pointer with qp_ctx in the affected transmission path, eliminating the post-free dereference.

Workarounds

Unload the hisi_sec2 kernel module on systems that do not require Hisilicon SEC2 hardware acceleration and fall back to software crypto
Reduce concurrent crypto workload to lower the probability of triggering the race until patches are deployed
Restrict local access on shared systems to limit who can drive sustained crypto offload

bash

# Check whether the hisi_sec2 driver is loaded
lsmod | grep hisi_sec2

# Temporarily unload the module if it is not required
sudo modprobe -r hisi_sec2

# Blacklist the module to prevent automatic load on boot
echo 'blacklist hisi_sec2' | sudo tee /etc/modprobe.d/blacklist-hisi-sec2.conf
sudo update-initramfs -u