What is CVE-2026-53240?

CVE-2026-53240 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 6.14 onward and patched in 6.18.36, 7.0.13 and 7.1. CVE-2026-53240 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53240?

CVE-2026-53240 has a CVSS score of 8.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-53240?

Yes, CVE-2026-53240 has been patched. Fixed versions include 6.18.36, 7.0.13 and 7.1. If you are running Linux kernel 6.14 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53240 actively exploited?

CVE-2026-53240 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2026-53240

High

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is still owned: if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb) Between spin_unlock and this read, a concurrent CPU running iptfs_reassem_cont() (or the drop_timer hrtimer) can complete reassembly, NULL xtfs->ra_newskb, and free the skb. The check then evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb operate on the freed skb — a use-after-free in skbuff_head_cache. Replace the unlocked read with a local bool that records whether first_skb was handed to the reassembly state in the current call. The flag is set after the existing spin_unlock, before the break, using the pointer equality that is stable at that point (first_skb == skb iff first_skb was stored in ra_newskb).

Package Linux Kernel

Published 2026-06-25

Last modified 2026-07-08

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

8.8

out of 10

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2026-53240 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.14 and later are affected. Fixed in 6.18.36, 7.0.13, 7.1 and their respective stable series.

Affected from

≥ 6.14

Fixed in

✓ 6.18.36 6.18.x ✓ 7.0.13 7.0.x ✓ 7.1

References

3 total

Kernel Git
https://git.kernel.org/stable/c/8d9a79fbf5172d9c4c0146057af2360913265a11

Patch
Kernel Git
https://git.kernel.org/stable/c/eb48730bb827d1550401a5d391903f9d90b493c8

Patch
Kernel Git
https://git.kernel.org/stable/c/ff2ee35b6ce5fa8a8e24ea50b15733d5c8780198

Patch

Details

CVE ID CVE-2026-53240

Severity High

CVSS score 8.8 / 10

CVSS version 3.1

Published 2026-06-25

Modified 2026-07-08

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53240?

CVE-2026-53240 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 6.14 onward and has been patched in 6.18.36, 7.0.13 and 7.1. CVE-2026-53240 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53240?

CVE-2026-53240 has a CVSS score of 8.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-53240?

Yes. CVE-2026-53240 has been patched. Fixed versions include 6.18.36, 7.0.13 and 7.1. If you are running Linux kernel 6.14 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53240 actively exploited?

No. CVE-2026-53240 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.