CVE-2026-53239: Linux Kernel xfrm Use-After-Free Privilege Escalation

Technical summary

The vulnerability exists in xfrm_policy_bysel_ctx() within the Linux kernel's IPsec policy framework. A race condition arises between two concurrent operations: (1) XFRM_MSG_DELPOLICY deleting a policy, which acquires the xfrm_policy_lock, removes the policy from its bin, then releases the lock before invoking xfrm_policy_kill(); and (2) XFRM_MSG_NEWSPDINFO triggering a hash rebuild via xfrm_hash_rebuild(), which acquires the lock and calls __xfrm_policy_inexact_flush() to free policy bins via kfree_rcu(). During the window after the first lock release and before the subsequent prune operation, the bin structure can be deallocated by the second CPU, leaving a dangling pointer. When the first CPU later calls xfrm_policy_inexact_prune_bin() on the freed bin, it triggers a use-after-free (UAF) condition. The fix moves the bin pruning operation inside the critical section protected by xfrm_policy_lock, eliminating the unsafe window.

Business impact

Exploitation enables local privilege escalation on affected systems, allowing unprivileged users to gain kernel-level code execution. This permits attackers to compromise confidentiality, integrity, and availability of the host. In containerized or multi-tenant environments, a compromised container or low-privilege process can break isolation boundaries. The impact extends to any service or workload running on the affected kernel, making patch deployment a priority for systems exposed to untrusted local users.

Affected systems

All versions of the Linux kernel using the xfrm IPsec policy subsystem are potentially affected. This includes mainline kernels and distributions (such as Ubuntu, Debian, RHEL, etc.) that carry the vulnerable code. Verify the specific patch version and affected ranges from your distribution's security advisory. Systems with local user access restrictions have lower practical risk than those permitting arbitrary user accounts.

Exploitability

The vulnerability requires local code execution (AV:L) with user-level privileges (PR:L) and no special user interaction (UI:N). However, it is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active in-the-wild exploitation has been widely reported at the time of CVE publication. The race condition has a narrow trigger window but is reliably reproducible through concurrent syscalls. Exploitation does not require kernel debug symbols or KASLR bypass techniques for denial-of-service outcomes, though reliable code execution may require additional heap grooming or information disclosure.

Remediation

Patch your kernel to a version that includes the fix for this vulnerability. The remedy involves modifying xfrm_policy_bysel_ctx() to call __xfrm_policy_inexact_prune_bin() while the xfrm_policy_lock spinlock is still held, and removing the now-unused wrapper function xfrm_policy_inexact_prune_bin(). Consult your Linux distribution's security advisory for the specific kernel version or patch level that resolves CVE-2026-53239. Reboot is required after kernel patching.

Patch guidance

Contact your Linux vendor (Ubuntu, Debian, Red Hat, SUSE, etc.) for the patched kernel version addressing CVE-2026-53239. Apply patches according to your change management policy, prioritizing systems exposed to untrusted local users. Kernel updates typically require a reboot; schedule downtime accordingly. Verify patch application by checking kernel version post-reboot and confirming the xfrm policy code path no longer contains the UAF window. For custom or self-compiled kernels, apply the upstream commit that relocates the prune operation into the locked critical section.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for memory corruption indicators such as 'use-after-free' warnings, general protection faults, or segmentation faults in kernel code paths involving xfrm_policy_* functions. System-level monitoring tools like kmesg analyzers or automated crash reporting can flag these events. During active exploitation attempts, network-based indicators may be limited; detection relies primarily on host-based telemetry. Consider enabling kernel address sanitizer (KASAN) in test environments to catch UAF conditions early. Intrusion detection systems tuned to xfrm-related syscalls (netlink operations) under high concurrency may detect exploitation patterns.

Why prioritize this

HIGH CVSS (7.8) with local privilege escalation potential warrants expedited patching. The vulnerability is not yet publicly exploited (KEV status: no), providing a window to patch before threat actors weaponize it. Local-only exposure reduces risk in well-segmented networks with restricted user access, but any system permitting untrusted local code (development machines, shared hosting, containers) requires immediate attention. Urgency is elevated for kernel versions with longer support windows.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L, common in supply chain and privilege escalation chains), low complexity (AC:L, no special conditions needed), low privileges required (PR:L, standard user account sufficient), no user interaction, scope unchanged, and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The score does not account for exploit code maturity or real-world prevalence; however, the absence from KEV indicates exploitation has not yet become routine.

Frequently asked questions