CVE-2026-53259: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53259 Overview

CVE-2026-53259 is a use-after-free vulnerability in the Linux kernel's IPv6 anycast subsystem. The flaw was reported by syzbot as a slab-use-after-free in ipv6_chk_acast_addr(). The function walks the global inet6_acaddr_lst[] hash under Read-Copy-Update (RCU) and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash. A race between __ipv6_dev_ac_inc() and ipv6_ac_destroy_dev() allows a teardown path to drop the anycast address reference before insertion into the global hash completes. Maintainers resolved the issue by moving ipv6_add_acaddr_hash() inside the idev->lock critical section so that ac_list and hash insertions are atomic with respect to device teardown.

Critical Impact
Concurrent IPv6 anycast join and network device teardown can free a hashed ifacaddr6 object, leading to kernel memory corruption when later RCU readers dereference the dangling node.

Affected Products

Linux kernel mainline (IPv6 anycast subsystem in net/ipv6/anycast.c)
Stable kernel branches tracked by commits 15be7e9fdbff, 3a967c498baa, and f723ccaff2fb
Distributions shipping vulnerable Linux kernel versions prior to the referenced stable backports

Discovery Timeline

2026-06-25 - CVE-2026-53259 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53259

Vulnerability Analysis

The vulnerability is a race condition that produces a use-after-free in the IPv6 anycast address management code [CWE-416]. In __ipv6_dev_ac_inc(), a new struct ifacaddr6 is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across an unlocked region. The structure is published to idev->ac_list while holding idev->lock, but the call to ipv6_add_acaddr_hash() executes after write_unlock_bh(idev->lock).

This unlocked window allows ipv6_ac_destroy_dev() running under RTNL on another CPU to acquire idev->lock, pull the anycast address off ac_list, and invoke ipv6_del_acaddr_hash(). Because the address has not yet been inserted into inet6_acaddr_lst[], the hlist_del_init_rcu() call is a no-op, and the matching aca_put() drops the refcount. When CPU0 resumes and finally performs the hash insertion followed by its own aca_put(), the final reference is released and call_rcu(aca_free_rcu) schedules kfree() while the node still resides in the global hash.

Root Cause

The root cause is non-atomic publication of the anycast address across two data structures. RTNL previously serialized the join path against device teardown, masking the bug. Once RTNL stopped providing that serialization, the gap between ac_list insertion and global hash insertion became reachable by a concurrent teardown, leaving a freed object linked in inet6_acaddr_lst[] for RCU readers to dereference.

Attack Vector

An attacker with the ability to trigger IPv6 anycast joins and device teardowns concurrently can race the two paths to free a hashed ifacaddr6. Subsequent calls into ipv6_chk_acast_addr() then dereference the freed slot, which can lead to kernel memory corruption, information disclosure, or denial of service depending on how the freed slab slot is reused. The bug was originally reproduced by the syzkaller fuzzer.

No public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.161%.

// No verified exploit code available. See the syzbot report and the upstream
// fix commits referenced below for the race window and patch diff.

Detection Methods for CVE-2026-53259

Indicators of Compromise

KASAN reports referencing slab-use-after-free in ipv6_chk_acast_addr in kernel logs or dmesg.
Lockdep warnings about IRQ lock inversion involving acaddr_hash_lock and idev->lock.
Unexpected kernel oopses or panics during heavy IPv6 anycast activity combined with interface teardown (ip link set ... down, namespace deletion).

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface the use-after-free at the point of dereference.
Run syzkaller or equivalent kernel fuzzing harnesses that exercise IPv6 anycast joins concurrently with addrconf_ifdown() paths.
Correlate kernel crash telemetry with workloads that frequently create, join multicast or anycast groups on, and destroy network interfaces or network namespaces.

Monitoring Recommendations

Forward kernel.crit and KASAN messages from production hosts into a centralized log pipeline and alert on ipv6_chk_acast_addr or aca_free_rcu strings.
Track kernel package versions across the fleet and flag hosts running kernels without the upstream fix commits 15be7e9fdbff, 3a967c498baa, or f723ccaff2fb.
Monitor for repeated container or network namespace churn that exercises the affected join and teardown paths.

How to Mitigate CVE-2026-53259

Immediate Actions Required

Inventory Linux kernel versions in use and identify hosts running vulnerable builds, prioritizing systems that rely heavily on IPv6 anycast or container networking.
Apply vendor-provided kernel updates that include the upstream fix as soon as they are available from your distribution.
For self-built kernels, cherry-pick the patches from git.kernel.org referenced below and rebuild affected images.

Patch Information

The fix moves ipv6_add_acaddr_hash() inside the idev->lock write-locked section so that insertion into ac_list and inet6_acaddr_lst[] is atomic with respect to teardown. A racing remover now either misses the anycast address entirely or finds it in both lists. Because acaddr_hash_lock is now nested under idev->lock, which is acquired in softirq context, all acaddr_hash_lock sites are switched to spin_lock_bh() to avoid the IRQ lock inversion reported separately. The upstream commits are available at kernel.org commit 15be7e9fdbff, kernel.org commit 3a967c498baa, and kernel.org commit f723ccaff2fb.

Workarounds

Where patching is not immediately possible, reduce concurrent IPv6 anycast join and device teardown activity, for example by serializing container and namespace tear-down operations.
Disable IPv6 on hosts that do not require it via sysctl net.ipv6.conf.all.disable_ipv6=1 if operationally acceptable.
Restrict the ability of unprivileged users to create and tear down network namespaces by setting kernel.unprivileged_userns_clone=0 on distributions that expose this tunable.

bash

# Verify the running kernel and check for the fix commits
uname -r
# Disable IPv6 as a temporary mitigation if anycast is not required
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
# Restrict unprivileged namespace creation to reduce attack surface
sudo sysctl -w kernel.unprivileged_userns_clone=0