GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53355 (GCVE-0-2026-53355)

Vulnerability from cvelistv5 – Published: 2026-07-01 13:32 – Updated: 2026-08-05 12:35
VLAI
Title
net: rds: clear i_sends on setup unwind
Summary
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 66cccec111421a10efdc2c74499d15b93e7acae5 (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 29d940026dce39e3018dab6f67c9427249321270 (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < e7cf30aa5f1fc6c2a86df65df8b731df20e44d79 (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 1d4ec754ee3871f7e3670c67bb0298c9c5760926 (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 27040bbca289a704eafcacca167d310c6ce2b1bc (git)
Affected: 3b12f73a5c2977153f28a224392fd4729b50d1dc , < 20cf0fb715c41111469577e85e35d15f099473e0 (git)
Affected: 75a12b2fa80c2e4cc40a9f9305f95899850b7426 (git)
Affected: c9459693fae9a1bf3f51f3db98617f694112e897 (git)
Affected: 13099ee9c7d54b0a25f6c8397675aed99e9cfa45 (git)
Affected: 5c6712ab4efb6cf60e16719ab6bcaface9cc268c (git)
Affected: 3.18.74 , < 3.19 (semver)
Affected: 4.1.46 , < 4.2 (semver)
Affected: 4.4.91 , < 4.5 (semver)
Affected: 4.9.54 , < 4.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "29d940026dce39e3018dab6f67c9427249321270",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "lessThan": "20cf0fb715c41111469577e85e35d15f099473e0",
              "status": "affected",
              "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9459693fae9a1bf3f51f3db98617f694112e897",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c",
              "versionType": "git"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.74",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.46",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.54",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib_cm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.74",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.54",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable RDS/IB setup path is reachable by a remote RDMA/RDS peer through RDMA CM connection requests handled by the kernel listener, before any RDS-level authentication. It is also reachable locally via AF_RDS send-triggered connects, but the remote network path is the higher-severity reasonable scenario.\nAC:L - The bug is triggered when `i_recvs` allocation fails after `i_sends` was allocated, and an attacker can drive repeated connection setup/resource pressure to reach that condition. No race or victim-controlled timing is required.\nPR:N - The incoming RDMA CM connect path requires no local account or authenticated RDS credentials. Local AF_RDS access is unprivileged in the initial network namespace, but the remote path makes privileges none.\nUI:N - No victim user action is needed once the RDS/IB listener is present. Connection setup and teardown are handled by kernel workqueues/CM callbacks.\nS:U - The corruption occurs inside the host kernel RDS/IB connection state and does not cross a separate security authority such as a guest-host or IOMMU boundary. This is standard kernel compromise/DoS scope.\nC:H - The stale `i_sends` pointer creates a use-after-free/double-free of kernel memory and the teardown path reads the freed send ring. Under the required high-severity assumption for UAF-style memory corruption, this can support kernel memory disclosure.\nI:H - The same stale-pointer/double-free condition can corrupt kernel allocator state or operate on attacker-reused freed memory. As kernel memory corruption, it is defensibly scored as capable of arbitrary write/control-flow impact.\nA:H - At minimum, the later shutdown pass can dereference and free an already freed kernel allocation, causing an oops, panic, or allocator corruption. Repeated unauthenticated connection attempts can therefore crash or destabilize the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:04.534Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"
        },
        {
          "url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"
        },
        {
          "url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"
        }
      ],
      "title": "net: rds: clear i_sends on setup unwind",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53355",
    "datePublished": "2026-07-01T13:32:30.831Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-05T12:35:04.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53355",
      "date": "2026-09-20",
      "epss": "0.00421",
      "percentile": "0.36066"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:49:56.000Z",
      "cve": "CVE-2026-53355",
      "id": "msrc_CVE-2026-53355",
      "initial_release_date": "2026-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: rds: clear i_sends on setup unwind",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53355.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/rds/ib_cm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29d940026dce39e3018dab6f67c9427249321270",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20cf0fb715c41111469577e85e35d15f099473e0",
                    "status": "affected",
                    "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c9459693fae9a1bf3f51f3db98617f694112e897",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "affected",
                    "version": "3.18.74",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "affected",
                    "version": "4.1.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "affected",
                    "version": "4.4.91",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.54",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/rds/ib_cm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6EF17A38-41B0-44A8-9AA7-59F934468699",
                    "versionEndExcluding": "3.19",
                    "versionStartIncluding": "3.18.74",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD7B43DB-D99B-4203-84D2-00416A5FC499",
                    "versionEndExcluding": "4.2",
                    "versionStartIncluding": "4.1.46",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E470178B-3110-4B83-8604-3F2FECD775D9",
                    "versionEndExcluding": "4.5",
                    "versionStartIncluding": "4.4.91",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "77BE86A0-6550-4518-835F-C6792092720A",
                    "versionEndExcluding": "4.10",
                    "versionStartIncluding": "4.9.54",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5678E1DD-11E1-4E0E-8B6F-A6A6ED57FE8A",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "4.11.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
                    "versionEndExcluding": "6.12.94",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
                    "versionEndExcluding": "6.18.36",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
                    "versionEndExcluding": "7.0.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:-:*:*:*:*:*:*",
                    "matchCriteriaId": "623D643F-123E-4D3E-8CBF-16BF845D734B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "64F78CCF-F54B-4D1C-AFA6-DE4076C3A263",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A659506C-868E-4E87-B0D8-E901BC2E9BDC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "ACE2C8C3-F2AA-4A39-9D81-B0F8BB82B834",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "D67BFFD0-1A52-4F5D-98DB-D94B58FD8D30",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "7D996F38-22AC-4059-84FC-F7D69CE0CB9B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "97EFF4F7-E5F9-4FAA-AD58-94A24501AD59",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."
          }
        ],
        "id": "CVE-2026-53355",
        "lastModified": "2026-07-22T19:14:36.650",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-01T14:16:43.790",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-18T08:05:30+00:00",
      "cve": "CVE-2026-53355",
      "id": "CVE-2026-53355",
      "initial_release_date": "2026-07-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: rds: clear i_sends on setup unwind",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53355.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:37:18Z",
      "cve": "CVE-2026-53355",
      "id": "CVE-2026-53355",
      "initial_release_date": "2026-07-03T03:03:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "617",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53355",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53355.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.