What is CVE-2026-53157?

CVE-2026-53157 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 2.6.33 onward and patched in 5.10.260, 5.15.211, 6.1.177 and others. CVE-2026-53157 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53157?

CVE-2026-53157 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-53157?

Yes, CVE-2026-53157 has been patched. Fixed versions include 5.10.260, 5.15.211, 6.1.177 and others. If you are running Linux kernel 2.6.33 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53157 actively exploited?

CVE-2026-53157 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2026-53157

High

In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type.

Package Linux Kernel

Published 2026-06-25

Last modified 2026-07-07

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2026-53157 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.33 and later are affected. Fixed in 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.36, 7.0.13, 7.1 and their respective stable series.

Affected from

≥ 2.6.33

Fixed in

✓ 5.10.260 5.10.x ✓ 5.15.211 5.15.x ✓ 6.1.177 6.1.x ✓ 6.6.144 6.6.x ✓ 6.12.95 6.12.x ✓ 6.18.36 6.18.x ✓ 7.0.13 7.0.x ✓ 7.1

References

8 total

Kernel Git
https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0

Patch
Kernel Git
https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578

Patch
Kernel Git
https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001

Patch
Kernel Git
https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763

Patch
Kernel Git
https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-53157

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-06-25

Modified 2026-07-07

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53157?

CVE-2026-53157 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 2.6.33 onward and has been patched in 5.10.260, 5.15.211, 6.1.177 and others. CVE-2026-53157 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53157?

CVE-2026-53157 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-53157?

Yes. CVE-2026-53157 has been patched. Fixed versions include 5.10.260, 5.15.211, 6.1.177 and others. If you are running Linux kernel 2.6.33 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53157 actively exploited?

No. CVE-2026-53157 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.