CVE-2026-53264 (GCVE-0-2026-53264)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
net/sched: act_api: use RCU with deferred freeing for action lifecycle
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 98b2e40879abf0245be5a5b7af69e0f6ff524ac3 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 18af5d2ef0c4f65787fd1280c8b23286b9f2a835 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 1f1b98fea6b9ea30507d0f2fbff6750292d097e2 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 5dd51e09020c65aa53cf128e5e3517cd53b3c113 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < b60e9391142e983fab2be53497aa8f71fdd09cd5 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 91d105d2cbe002f9c7b43a6183adedc37e1da1f7 (git)
Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 5057e1aca011e51ef51498c940ef96f3d3e8a305 (git)
Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53264",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T03:55:26.363824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T18:15:51.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98b2e40879abf0245be5a5b7af69e0f6ff524ac3",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "18af5d2ef0c4f65787fd1280c8b23286b9f2a835",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "1f1b98fea6b9ea30507d0f2fbff6750292d097e2",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "8b136f18ac4b2ace5aaad3305b3f8a5d8165a009",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "5dd51e09020c65aa53cf128e5e3517cd53b3c113",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "b60e9391142e983fab2be53497aa8f71fdd09cd5",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "91d105d2cbe002f9c7b43a6183adedc37e1da1f7",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "5057e1aca011e51ef51498c940ef96f3d3e8a305",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet\u0027s illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() \u003c-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() \u003c-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet\u0027s illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0\u0027s subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:41.215Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3"
        },
        {
          "url": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113"
        },
        {
          "url": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305"
        }
      ],
      "title": "net/sched: act_api: use RCU with deferred freeing for action lifecycle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53264",
    "datePublished": "2026-06-25T08:39:51.870Z",
    "dateReserved": "2026-06-09T07:44:35.395Z",
    "dateUpdated": "2026-08-05T12:34:41.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53264",
      "date": "2026-08-06",
      "epss": "0.00205",
      "percentile": "0.10671"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:47:58.000Z",
      "cve": "CVE-2026-53264",
      "id": "msrc_CVE-2026-53264",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_api: use RCU with deferred freeing for action lifecycle",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53264.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53264\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:44.400\",\"lastModified\":\"2026-07-29T19:16:46.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\\n\\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\\nrace with an associated action.\\n\\nLet\u0027s illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\\n\\n 0: mutex_lock() \u003c-- holds the idr lock\\n 0: rcu_read_lock()\\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\\n 0: mutex_unlock() \u003c-- releases the idr lock\\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\\n\\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\\nadding struct rcu_head to tc_action used in the deferral and introducing a\\ncall_rcu() in the delete path to defer the final kfree().\\n\\nNote: this is a revert of commit d7fb60b9cafb (\\\"net_sched: get rid of tcfa_rcu\\\")\\nbut also modernization/simplification to directly use kfree_rcu().\\n\\nLet\u0027s illustrate the new restored code path:\\n\\n 0: rcu_read_lock()\\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\\n 1: idr_remove(idr, index)\\n 1: mutex_unlock()\\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\\n 0: p = idr_find(idr, index)\\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\\n\\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\\nCPU0\u0027s subsequent idr_find() will return NULL, and even if it still held a\\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\\nperiod, so no UAF can occur.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/act_api.h\",\"net/sched/act_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"98b2e40879abf0245be5a5b7af69e0f6ff524ac3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"18af5d2ef0c4f65787fd1280c8b23286b9f2a835\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"1f1b98fea6b9ea30507d0f2fbff6750292d097e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"8b136f18ac4b2ace5aaad3305b3f8a5d8165a009\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"5dd51e09020c65aa53cf128e5e3517cd53b3c113\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"b60e9391142e983fab2be53497aa8f71fdd09cd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"91d105d2cbe002f9c7b43a6183adedc37e1da1f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\",\"lessThan\":\"5057e1aca011e51ef51498c940ef96f3d3e8a305\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/act_api.h\",\"net/sched/act_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T03:55:26.363824Z\",\"id\":\"CVE-2026-53264\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14\",\"versionEndExcluding\":\"5.10.259\",\"matchCriteriaId\":\"2CDA3B30-3B30-45B4-8931-6E0B99F68C44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.210\",\"matchCriteriaId\":\"5E938CDF-D1C4-43D0-98DC-9E11B6B55801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"C4446623-5F2B-4DD8-8666-9FAAC285A757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.143\",\"matchCriteriaId\":\"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.94\",\"matchCriteriaId\":\"85421C0C-ABDE-4357-971C-67F9087DE1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.36\",\"matchCriteriaId\":\"389025D2-958D-41BD-BD96-70ED1033A9F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-06T15:43:56+00:00",
      "cve": "CVE-2026-53264",
      "id": "CVE-2026-53264",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "228",
      "product_status:known_not_affected": "46",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53264.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-03T23:34:59Z",
      "cve": "CVE-2026-53264",
      "id": "CVE-2026-53264",
      "initial_release_date": "2026-06-26T02:08:10Z",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "20",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53264",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53264.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53264\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T03:55:26.363824Z\"}}}], \"references\": [{\"url\": \"https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/\", \"tags\": [\"exploit\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T18:14:25.538Z\"}}], \"cna\": {\"title\": \"net/sched: act_api: use RCU with deferred freeing for action lifecycle\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"98b2e40879abf0245be5a5b7af69e0f6ff524ac3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"18af5d2ef0c4f65787fd1280c8b23286b9f2a835\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"1f1b98fea6b9ea30507d0f2fbff6750292d097e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"8b136f18ac4b2ace5aaad3305b3f8a5d8165a009\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"5dd51e09020c65aa53cf128e5e3517cd53b3c113\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"b60e9391142e983fab2be53497aa8f71fdd09cd5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"91d105d2cbe002f9c7b43a6183adedc37e1da1f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da\", \"lessThan\": \"5057e1aca011e51ef51498c940ef96f3d3e8a305\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/act_api.h\", \"net/sched/act_api.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.259\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.176\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.143\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/act_api.h\", \"net/sched/act_api.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3\"}, {\"url\": \"https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835\"}, {\"url\": \"https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2\"}, {\"url\": \"https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009\"}, {\"url\": \"https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113\"}, {\"url\": \"https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5\"}, {\"url\": \"https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7\"}, {\"url\": \"https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\\n\\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\\nrace with an associated action.\\n\\nLet\u0027s illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\\n\\n 0: mutex_lock() \u003c-- holds the idr lock\\n 0: rcu_read_lock()\\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\\n 0: mutex_unlock() \u003c-- releases the idr lock\\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\\n\\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\\nadding struct rcu_head to tc_action used in the deferral and introducing a\\ncall_rcu() in the delete path to defer the final kfree().\\n\\nNote: this is a revert of commit d7fb60b9cafb (\\\"net_sched: get rid of tcfa_rcu\\\")\\nbut also modernization/simplification to directly use kfree_rcu().\\n\\nLet\u0027s illustrate the new restored code path:\\n\\n 0: rcu_read_lock()\\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\\n 1: idr_remove(idr, index)\\n 1: mutex_unlock()\\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\\n 0: p = idr_find(idr, index)\\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\\n\\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\\nCPU0\u0027s subsequent idr_find() will return NULL, and even if it still held a\\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\\nperiod, so no UAF can occur.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.259\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.210\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.176\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.143\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.94\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.36\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.13\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1\", \"versionStartIncluding\": \"4.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:34:41.215Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53264\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:34:41.215Z\", \"dateReserved\": \"2026-06-09T07:44:35.395Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-06-25T08:39:51.870Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.