CVE-2026-53275: Linux Kernel IPv6 MLD Query Use-After-Free Vulnerability

Technical summary

CVE-2026-53275 is a use-after-free vulnerability in the IPv6 multicast listener discovery (MLD) handling code (net/ipv6/mcast.c). During MLD query processing in __mld_query_work(), a pointer to the multicast group address is extracted early via packet parsing. Subsequent calls to pskb_may_pull() and pskb_expand_head() can reallocate the socket buffer (skb), invalidating the original pointer. The code then dereferences this stale pointer without reloading it, triggering a KASAN slab-use-after-free detection. The fix copies the multicast group address into a local variable at parse time, eliminating the dependency on the pointer remaining valid across buffer reallocations. This is a classic memory safety issue arising from pointer lifetime management in kernel packet-handling code.

Business impact

This vulnerability can cause kernel panic or denial of service on systems with IPv6 enabled. Any attacker capable of sending network packets to an affected host (typically from the same local network segment, given the AV:A vector) can crash the system or cause unpredictable behavior. For organizations running critical services on Linux servers with IPv6—especially those in cloud or data-center environments where multicast traffic may be present—an unexpected kernel crash disrupts availability. The HIGH severity rating reflects both the certainty of triggering the flaw and the direct impact on system stability.

Affected systems

The Linux kernel is affected. Based on the CVE record, multiple kernel versions are impacted. Verify the exact affected versions, patch versions, and distribution timelines against the official Linux kernel security advisories and your vendor's documentation. Systems with IPv6 enabled are at risk; however, exploitability may be constrained by network topology (the vulnerability requires local network access to send the malicious MLD query).

Exploitability

Exploitability is relatively straightforward from a technical perspective: an attacker on the same local network (AV:A in CVSS) can craft and send a malicious MLD query packet with no authentication required (PR:N) and no user interaction needed (UI:N). The payload is a network packet, making it trivial to send. However, practical exploitation depends on network segmentation. In isolated or air-gapped networks, exposure may be limited. In flat network architectures or cloud environments where multicast is routed, the attack surface is broader. The vulnerability is not yet tracked in the CISA KEV catalog as of the data provided.

Remediation

Apply the Linux kernel patch that copies the multicast group address during initial packet parsing, ensuring the address value is not dependent on the packet buffer pointer. Patch availability varies by distribution; check your Linux vendor's security advisories (Red Hat, Canonical, SUSE, etc.) for specific patch versions and kernel release dates. Systems unable to patch immediately should consider disabling IPv6 if operationally feasible, or implementing network-level controls to restrict MLD query traffic to trusted sources.

Patch guidance

Identify the specific Linux kernel version and distribution in your environment. Consult your vendor's security advisory for CVE-2026-53275 to obtain the patched kernel version and installation instructions. Typical patching steps: (1) verify current kernel version with 'uname -r'; (2) download the patched kernel from your vendor's update repository; (3) test the patch in a non-production environment first; (4) schedule a maintenance window for production systems (kernel updates typically require a reboot); (5) reboot and verify the system boots successfully and the vulnerability is resolved. Maintain backups before patching.

Detection guidance

Monitor kernel logs and audit systems for KASAN warnings, kernel panics, or oops messages mentioning mcast.c or __mld_query_work(). Specifically, look for 'slab-use-after-free' or 'use-after-free in __mld_query_work' strings in dmesg or systemd journal. Network-based detection is harder; however, intrusion detection signatures can look for malformed MLD query packets with unusual payload sizes or structures designed to trigger buffer reallocation. Enable kernel Address Sanitizer (KASAN) in testing/staging environments to catch similar issues early.

Why prioritize this

This vulnerability warrants high priority patching due to its CVSS 8.8 (HIGH) score, the ease of triggering a crash from the local network, and the direct business impact of kernel panic on service availability. Although it requires network access (AV:A), local networks are common in cloud, data center, and corporate environments. No advanced exploitation skills or special conditions are needed. The absence from the CISA KEV catalog does not diminish the risk; it reflects lack of active weaponization or widespread attacks at publication time, not severity.

Risk score, explained

CVSS 8.8 reflects: (1) Attack Vector Adjacent (AV:A)—the attacker must be on the same network segment; (2) Attack Complexity Low (AC:L)—no special conditions needed; (3) Privileges Required None (PR:N)—no credentials or special rights; (4) User Interaction None (UI:N)—the flaw triggers automatically upon packet receipt; (5) Impact on Confidentiality, Integrity, and Availability all High (C:H/I:H/A:H)—the use-after-free can leak kernel memory, corrupt data, or crash the system. The HIGH severity is justified given the reliability and severity of impact.

Frequently asked questions