{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: anycast: insert aca into global hash under idev-\u003elock  syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node.  In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev-\u003eac_list under idev-\u003elock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window:    CPU0 __ipv6_dev_ac_inc           CPU1 ipv6_ac_destroy_dev (RTNL)   ------------------------------   ------------------------------------   aca_alloc()              refcnt 1   aca_get()               refcnt 2   write_lock_bh(idev-\u003elock)     add aca to ac_list   write_unlock_bh(idev-\u003elock)                                    write_lock_bh(idev-\u003elock)                                      pull aca off ac_list                                    write_unlock_bh(idev-\u003elock)                                    ipv6_del_acaddr_hash(aca)                                      hlist_del_init_rcu() is a no-op,                                      aca is not in the hash yet                                    aca_put()           refcnt 2-\u003e1   ipv6_add_acaddr_hash(aca)     aca now inserted into the hash   aca_put()                refcnt 1-\u003e0     call_rcu(aca_free_rcu) -\u003e kfree(aca)  The hash removal becomes a no-op because the insertion has not happened yet, so once CPU0 inserts and drops the last reference, the aca is freed while still linked in inet6_acaddr_lst[], and readers dereference freed memory after the slab slot is reused.  This window opened once RTNL stopped serializing the join path against device teardown. Move ipv6_add_acaddr_hash() inside the idev-\u003elock section so the ac_list and hash insertions are atomic with respect to teardown: a racing remover now either misses the aca entirely or finds it in both lists.  acaddr_hash_lock is now nested under idev-\u003elock, which is acquired in softirq context, so switch all acaddr_hash_lock sites to spin_lock_bh() to avoid the irq lock inversion reported in [2].  [1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a [2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/",
  "id": "DEBIAN-CVE-2026-53259",
  "modified": "2026-09-14T16:47:39.434360159Z",
  "published": "2026-06-25T09:16:43.893Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53259"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53259"
  ]
}