CVE-2026-53292

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the phonet network component where the pn socket autobind() function incorrectly handles a failed bind operation. When pn socket bind() returns an -EINVAL error, the system assumes the socket was already bound and executes a BUG ON() assertion to verify the port is non-zero. However, pn socket bind() can return -EINVAL if the socket state is not TCP CLOSE, even if the socket has never been bound and the port remains zero. This sequence triggers a kernel panic via a user-triggerable path through the pn socket sendmsg() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.