CVE-2026-53175: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53175 Overview

CVE-2026-53175 is a use-after-free vulnerability in the Linux kernel's IP fragmentation reassembly code. The flaw resides in the fqdir_pre_exit() teardown path, which flushes fragment queues during network namespace destruction. inet_frag_queue_flush() frees queued socket buffers (skbs) but leaves q->fragments_tail and q->last_run_head pointing at the freed memory. A concurrent fragment that already obtained the queue through inet_frag_find() can then resume, dereference the freed fragments_tail, and trigger a slab use-after-free. IPv4, IPv6, nf_conntrack_reasm6, and 6lowpan reassembly all share this flush path and are affected [CWE-416].

Critical Impact
A race condition between network namespace teardown and in-flight fragment reassembly leads to a slab use-after-free in the Linux kernel network stack, potentially enabling memory corruption.

Affected Products

Linux kernel — IPv4 fragment reassembly (inet_frag)
Linux kernel — IPv6 fragment reassembly and nf_conntrack_reasm6
Linux kernel — 6lowpan reassembly

Discovery Timeline

2026-06-25 - CVE-2026-53175 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53175

Vulnerability Analysis

The vulnerability arises from incomplete cleanup during fragment queue flushing on network namespace teardown. fqdir_pre_exit() walks the fqdir rhashtable and calls inet_frag_queue_flush() on every incomplete fragment queue. That helper frees all skbs attached to the queue, but it does not mark the queue as INET_FRAG_COMPLETE, and it leaves q->fragments_tail and q->last_run_head referencing skbs that have been freed. The queue object itself remains in the rhashtable.

Before the flush, fqdir_pre_exit() lowers high_thresh to zero to prevent new queue lookups. However, this does not stop a fragment that already obtained the queue via inet_frag_find() and is stalled waiting for the queue lock. When that fragment resumes after the flush and acquires the lock, it passes the INET_FRAG_COMPLETE check because the flag was never set. It then enters inet_frag_queue_insert(), which reads FRAG_CB() and ->len from the stale fragments_tail pointer and writes ->next_frag on the append path. These operations touch already freed memory.

Root Cause

The root cause is missing state reset in inet_frag_queue_flush(). After freeing the queued skbs, the helper leaves rb_fragments, fragments_tail, and last_run_head pointing at the freed objects without setting INET_FRAG_COMPLETE. Any thread that holds a reference to the queue and resumes after the flush observes a queue that appears valid but contains dangling pointers.

Attack Vector

Exploitation requires triggering reassembly of IP fragments concurrently with destruction of a network namespace that holds those fragments. A local attacker with the ability to create network namespaces and inject IP or IPv6 fragments can race the teardown against an in-flight reassembly. Successful exploitation corrupts the slab allocator's metadata and can be leveraged for kernel memory corruption.

The upstream fix resets rb_fragments, fragments_tail, and last_run_head inside inet_frag_queue_flush(). After the fix, a fragment that resumes post-flush sees an empty queue and starts a new run instead of dereferencing freed memory. The duplicate reset previously performed in ip_frag_reinit() is removed. Patches are tracked in commits 010c3313, 0e823ca0, 32594b09, 89b909e9, and c22599cc.

Detection Methods for CVE-2026-53175

Indicators of Compromise

KASAN slab-use-after-free reports referencing inet_frag_queue_insert, inet_frag_queue_flush, or fqdir_pre_exit in kernel logs.
Unexpected kernel oops or panic during network namespace teardown on hosts processing IP or IPv6 fragments.
Sporadic crashes in nf_conntrack_reasm6 or 6lowpan reassembly paths under container or VM churn.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface use-after-free conditions in the fragment reassembly path.
Audit kernel crash dumps for backtraces that include inet_frag_find, inet_frag_queue_insert, and fqdir_pre_exit.
Correlate netns teardown events with kernel warnings and panics in centralized log telemetry.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log store and alert on KASAN, BUG, or general protection fault entries.
Monitor workloads that frequently create and destroy network namespaces, such as container orchestrators, for kernel instability.
Track installed kernel versions across the fleet to confirm coverage of the upstream fix.

How to Mitigate CVE-2026-53175

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the inet_frag_queue_flush() reset fix.
Identify hosts that run container or virtualization workloads with frequent network namespace churn and prioritize patching them first.
Restrict creation of user namespaces and network namespaces for untrusted local users where feasible.

Patch Information

The fix resets rb_fragments, fragments_tail, and last_run_head in inet_frag_queue_flush() and removes the duplicate reset in ip_frag_reinit(). Backports are available across stable trees in commits 010c3313, 0e823ca0, 32594b09, 89b909e9, and c22599cc. Consult your distribution vendor for the corresponding package release.

Workarounds

Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 where supported to reduce local race exposure.
Avoid rapid creation and teardown of network namespaces on shared multi-tenant hosts until patched kernels are deployed.
Where IP fragmentation is not required, drop fragmented traffic at the host firewall to shrink the attack surface.

bash

# Verify the running kernel version and compare to your distribution's patched build
uname -r

# Reduce local race exposure on systems that do not require unprivileged namespaces
sysctl -w kernel.unprivileged_userns_clone=0

# Optional: drop IPv4 fragments at the host firewall if not needed by the workload
iptables -A INPUT -f -j DROP