CVE-2026-53175

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists during network namespace teardown. The function fqdir pre exit() flushes incomplete fragment queues via inet frag queue flush(), which frees queued socket buffers (skbs) but fails to clear the fragments tail and last run head pointers. If a fragment previously obtained through inet frag find() resumes execution and acquires the queue lock after this flush, it may dereference the freed fragments tail. Subsequently, inet frag queue insert() reads and writes to these freed pointers, leading to a slab use-after-free. This issue also affects IPv6, nf conntrack reasm6, and 6lowpan reassembly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.