CVE-2026-53157: use-after-free in Linux Phonet driver

Use-after-free in Linux Phonet driver. CVSS 7.8. Reproducer with KASAN evidence published today.

CVE-2026-53157 is a use-after-free vulnerability in the Phonet driver of the Linux kernel, located in the phonet_device_destroy() function. The function removes a device from the RCU list using list_del_rcu() but frees it immediately, allowing RCU readers to continue holding pointers to already-removed objects. This results in access to deallocated memory (slab-use-after-free) in Linux systems using the Phonet protocol for network communications.

The vulnerability has a CVSS score of 7.8 (high severity). As of today (November 2, 2026), a significant GitHub signal is present: complete technical documentation has been published including a reproducer and KASAN evidence that concretely demonstrates the flaw. This adds tangible verification to the initial NVD recognition from June 25.

IT teams and system administrators must immediately verify whether their Linux infrastructure uses the Phonet driver. It is essential to consult official advisories from your distribution (Red Hat, Debian, Ubuntu, SUSE, etc.) for specific patches. The official fix replaces kfree() with kfree_rcu() in the affected function, ensuring memory is not freed before the RCU grace period is complete. Updating the kernel as soon as patches are available is a priority.

At a glance

What: Use-after-free in phonet_device_destroy() in the Linux kernel, Phonet component. The function removes a device using list_del_rcu() but frees it immediately, allowing RCU readers to maintain pointers to already-deallocated memory (slab-use-after-free).
Severity: High. CVSS 7.8. A memory safety vulnerability in the kernel that can cause denial of service or system compromise on Linux systems.
Affected versions: Not reported in the official NVD description. Consult advisories from affected distributions (Red Hat, Debian, Ubuntu, SUSE).
Fix: Use of kfree_rcu() instead of kfree() in phonet_device_destroy(), to respect the RCU grace period. This solution aligns the practice with what is already used by phonet_address_del() for the same object type.
Status: Published in NVD on June 25, 2026. On November 2, 2026, a complete reproducer with write-up and KASAN evidence was reported on GitHub, increasing technical verification of the vulnerability.
Action: Immediately verify whether your Linux systems use the Phonet driver. Consult official advisories from your distribution. Apply patches as soon as available. Update the kernel according to your infrastructure's patching cycle.

Sources: NVD, CVE-2026-53157

← All articles