CVE-2026-53157: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53157 Overview

CVE-2026-53157 is a use-after-free vulnerability in the Linux kernel's Phonet protocol implementation. The flaw exists in phonet_device_destroy(), which removes a phonet_device from the per-net device list using list_del_rcu() but frees the object immediately afterward. Read-Copy-Update (RCU) readers traversing the same list can retain a pointer to the freed object, resulting in a slab-use-after-free condition. The upstream fix replaces the immediate free with kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.

Critical Impact
A use-after-free in kernel network code can lead to memory corruption, denial of service, or potential privilege escalation when concurrent RCU readers access freed phonet_device memory.

Affected Products

Linux kernel (Phonet subsystem, net/phonet)
Stable kernel branches receiving commits 52b8f5ef, 71de0177, and bff309ea
Distributions shipping vulnerable kernel versions prior to the fix

Discovery Timeline

2026-06-25 - CVE-2026-53157 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53157

Vulnerability Analysis

The Phonet protocol stack maintains per-network-namespace lists of phonet_device structures. These lists are protected by RCU, allowing readers to traverse them without taking locks. The function phonet_device_destroy() uses list_del_rcu() to unlink an entry from the list, signaling that the element is no longer reachable from the list head. However, the function then immediately frees the underlying memory.

This breaks RCU's core invariant: any reader that began list traversal before the list_del_rcu() call may still hold a valid pointer into the removed object. Freeing the memory before all in-flight readers complete their critical sections produces a slab-use-after-free when those readers dereference the stale pointer.

The correct pattern, already applied by phonet_address_del() for the same object type, defers the free until after a grace period using kfree_rcu(). The fix aligns phonet_device_destroy() with this established lifetime rule.

Root Cause

The root cause is a mismatch between RCU list removal semantics and the object deallocation strategy. list_del_rcu() only guarantees that future readers will not observe the element; it does not wait for existing readers. Calling kfree() directly after list_del_rcu() violates the publish-subscribe contract enforced by RCU.

Attack Vector

Triggering the condition requires concurrency between Phonet device teardown and any RCU read-side path that walks the per-net device list. A local attacker with the ability to create, query, and destroy Phonet devices can race these operations to dereference freed slab memory. The vulnerability resides in kernel networking code that is reachable from process context handling Phonet sockets and netlink operations.

No verified exploitation code is publicly available. Technical details are documented in the upstream commits referenced below:

Detection Methods for CVE-2026-53157

Indicators of Compromise

KASAN reports flagging slab-use-after-free in phonet_device_destroy or adjacent Phonet list-walk functions
Kernel panics or oops messages referencing net/phonet/pn_dev.c call sites
Unexpected kernel memory corruption coinciding with Phonet socket activity

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test and staging kernels to surface use-after-free conditions during Phonet stress testing
Audit installed kernel versions against the patched commits to identify systems still running vulnerable code
Monitor dmesg and centralized log streams for kernel oops, BUG, or KASAN entries referencing Phonet symbols

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on phonet, use-after-free, or KASAN keywords
Track loaded kernel modules and flag hosts where the phonet module is loaded but the Phonet protocol is not operationally required
Correlate kernel crash telemetry with low-privileged process activity that opens AF_PHONET sockets

How to Mitigate CVE-2026-53157

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 52b8f5ef, 71de0177, and bff309ea once available in your distribution
Inventory all Linux hosts and identify systems running kernel versions prior to the fix
Blacklist the phonet kernel module on systems that do not require Phonet protocol support

Patch Information

The fix replaces the immediate kfree() after list_del_rcu() with kfree_rcu(), deferring deallocation until after an RCU grace period. This aligns phonet_device_destroy() with the lifetime management already used by phonet_address_del(). Consult your distribution's security tracker for backported package versions and rebuild kernels from stable trees containing the referenced commits.

Workarounds

Prevent loading of the Phonet module by adding install phonet /bin/true to a file under /etc/modprobe.d/
Restrict the ability of unprivileged users to create AF_PHONET sockets via seccomp or LSM policy
Where Phonet is not required, unload the module with modprobe -r phonet after confirming no active dependencies

bash

# Configuration example: disable the phonet module
echo 'install phonet /bin/true' | sudo tee /etc/modprobe.d/disable-phonet.conf
sudo modprobe -r phonet 2>/dev/null || true
lsmod | grep -i phonet