{"schema_version":"1.7.5","id":"CVE-2026-53239","published":"2026-06-25T08:39:35.149Z","modified":"2026-07-22T18:14:47.370881916Z","related":["CGA-wf6r-4xrc-w93w","SUSE-SU-2026:3130-1","SUSE-SU-2026:3166-1"],"summary":"xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n  CPU0 (XFRM_MSG_DELPOLICY)           CPU1 (XFRM_MSG_NEWSPDINFO)\n  ==========================          ==========================\n  xfrm_policy_bysel_ctx():\n    spin_lock_bh(xfrm_policy_lock)\n    bin = xfrm_policy_inexact_lookup()\n    __xfrm_policy_unlink(pol)\n    spin_unlock_bh(xfrm_policy_lock)\n    xfrm_policy_kill(ret)\n    // wide window, lock not held\n                                       xfrm_hash_rebuild():\n                                         spin_lock_bh(xfrm_policy_lock)\n                                         __xfrm_policy_inexact_flush():\n                                           kfree_rcu(bin)  // bin freed\n                                         spin_unlock_bh(xfrm_policy_lock)\n    xfrm_policy_inexact_prune_bin(bin)\n    // UAF: bin is freed","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6be3b0db6db82cf056a72cc18042048edd27f8ee"},{"fixed":"8fc536e9f6856230f19c7d13e71af064b6a77b22"},{"fixed":"c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"},{"fixed":"25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"},{"fixed":"42827d03f8009a6a218bacab153e21f39d6a121c"},{"fixed":"88697cf980222d5906a37bf47662dac0732e2a0f"},{"fixed":"b5316e2b8614a87d8736941972441cb47bfd4491"},{"fixed":"ec82ea4eb220164d854f8734ca5a35e23e577b94"},{"fixed":"7f2d76c9c03257c0782afef9d95321fa04096f60"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53239.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53239.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53239.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53239"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53239.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}