CVE-2026-53157: Linux Kernel Phonet Use-After-Free Privilege Escalation Risk

Technical summary

CVE-2026-53157 is a use-after-free vulnerability (CWE-416) in the Linux kernel's net/phonet module. The phonet_device_destroy() function calls list_del_rcu() to remove a phonet_device from a per-network-namespace device list, but immediately frees the object via kfree(). RCU (Read-Copy-Update) readers can still hold references to the freed memory after removal, leading to slab-use-after-free conditions. The remediation applies kfree_rcu() instead, deferring deallocation until a grace period elapses, matching the lifetime discipline already used by phonet_address_del() for the same data structure.

Business impact

A local unprivileged user can trigger this flaw to crash the kernel, causing denial of service. Depending on kernel configuration and attack timing, exploitation may also permit memory corruption or privilege escalation. The vulnerability requires local system access and does not require root, making it relevant for multi-tenant systems, containers, and shared hosting environments.

Affected systems

The Linux kernel is affected across multiple stable branches. Verify the specific kernel versions in your environment against the Linux kernel security advisory. Systems running Phonet networking support (net/phonet module) are in scope; check whether Phonet is enabled in your kernel configuration.

Exploitability

Exploitability is moderate. The vulnerability requires local code execution and does not require special privileges—any unprivileged user can trigger the race condition. No public exploit code is currently known (KEV status: not listed), but the flaw is straightforward to understand and the race window is discoverable. Active exploitation in the wild is not confirmed.

Remediation

Apply a Linux kernel update that incorporates the fix to phonet_device_destroy(). The patch replaces kfree() with kfree_rcu() to defer memory deallocation. Contact your Linux distribution vendor for the timing of availability in stable kernel releases for your supported versions.

Patch guidance

Identify the kernel version running on your systems using 'uname -r'. Check your Linux distribution's security advisories and update channels for availability of patched kernel builds. For enterprise distributions (Red Hat, SUSE, Ubuntu, Debian), updates are typically released through standard package management. Test patched kernels in a staging environment before production deployment. Kernel updates typically require a reboot.

Detection guidance

Monitor system logs for kernel crashes or warnings related to the Phonet subsystem (phonet_device_destroy, RCU stalls, use-after-free/slab errors). Enable kernel address sanitizer (KASAN) in development or test environments to catch such issues before they cause hard failures. Check if Phonet is actively in use in your environment; if not, disabling the module reduces attack surface.

Why prioritize this

This vulnerability merits high priority for systems with local users and Phonet enabled. The CVSS score of 7.8 (HIGH) reflects the confluence of local code execution, lack of privilege requirement, and availability/integrity/confidentiality impact. Systems without Phonet networking support or without untrusted local users can deprioritize. Multi-tenant platforms and shared hosting should address this promptly.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) is driven by: AV:L (attack vector local—requires system access), AC:L (attack complexity low—no special conditions), PR:L (privileges low—unprivileged user can trigger), UI:N (no user interaction required), and S:U/C:H/I:H/A:H (single scope, high confidentiality, integrity, and availability impact). The use-after-free can lead to memory corruption, kernel panic, and potential privilege escalation.

Frequently asked questions