CVE-2026-53275— IPv6 组播处理 MLD 查询时存在 Use-After-Free 漏洞
可能的 ATT&CK 技术 1AI
T1040 · Network Sniffing影响版本矩阵 16
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 97300b5fdfe28c6edae926926f9467a27cf5889c< 1354271c89d0e5fbf8b3d94097ff0216695209c7 | affected |
97300b5fdfe28c6edae926926f9467a27cf5889c< 53baa63a4183291574483f89583dbef13677a2c4 | affected | ||
97300b5fdfe28c6edae926926f9467a27cf5889c< 2a613bf497029d555a7428406aa8cdb84a503cea | affected | ||
97300b5fdfe28c6edae926926f9467a27cf5889c< b2eb8886200b907fc71806869620609f0f4cacb0 | affected | ||
97300b5fdfe28c6edae926926f9467a27cf5889c< 4203806f700bb44ea0b05d484d9d40044b47fb04 | affected | ||
97300b5fdfe28c6edae926926f9467a27cf5889c< 087dbacf897c020f438f780f0a4a8aa73b6d7c5a | affected | ||
97300b5fdfe28c6edae926926f9467a27cf5889c< 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 | affected | ||
2.6.15 | affected | ||
| … +8 条更多 | |||
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-53275 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
ipv6: mcast: Fix use-after-free when processing MLD queries
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK> [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-53275 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-53275 的情报信息
请登录查看更多情报信息。
CVE-2026-53275 补丁与修复 (7)
同批安全公告 · Linux · 2026-06-25 · 共 147 条
| CVE-2026-53221 | 9.8 CRITICAL | Linux ip6_vti vti6_tnl_lookup 隧道匹配错误漏洞 |
| CVE-2026-53228 | 9.8 CRITICAL | IPv6 SIT 在 GSO 卸载后重新加载内部 IPv6 头漏洞 |
| CVE-2026-53151 | 9.8 CRITICAL | rxrpc ACK解析器未正确提取SACK表 |
| CVE-2026-53216 | 9.8 CRITICAL | Marvell mvpp2 XDP 帧大小限制漏洞 |
| CVE-2026-53215 | 9.8 CRITICAL | Marvell mvpp2驱动RX缓冲区填充漏洞 |
| CVE-2026-53246 | 9.8 CRITICAL | SCTP缓存对端INIT分片长度验证缺陷 |
| CVE-2026-53247 | 9.8 CRITICAL | MTK以太网驱动元数据拆除时 Use-after-free漏洞 |
| CVE-2026-53176 | 9.8 CRITICAL | IB/isert: 拒绝短于ISER_HEADERS_LEN的登录PDU漏洞 |
| CVE-2026-53175 | 9.8 CRITICAL | Linux inet frag使用完后释放漏洞 |
| CVE-2026-53260 | 9.8 CRITICAL | TCP reqsk_queue_hash_req()嵌套抢占关闭/开启问题 |
| CVE-2026-53131 | 9.4 CRITICAL | netfilter：eth_hdr() 使用前需验证以太网MAC头 |
| CVE-2026-53186 | 9.1 CRITICAL | RDMA/srp SRP响应长度限制漏洞 |
| CVE-2026-53225 | 9.1 CRITICAL | Linux SCTP __sctp_rcv_asconf_lookup() 未初始化值漏洞 |
| CVE-2026-53224 | 9.1 CRITICAL | SCTP INIT 块及地址列表长度验证漏洞 |
| CVE-2026-53170 | 8.8 HIGH | Acceler/ethosu：拒绝长度未初始化的DMA命令漏洞 |
| CVE-2026-53188 | 8.8 HIGH | RDMA/core: ib_get_ucaps 传入fops验证漏洞 |
| CVE-2026-53248 | 8.8 HIGH | Airoha 网络驱动 metadata dst 拆除时存在释放后使用漏洞 |
| CVE-2026-53266 | 8.8 HIGH | netfilter bridge ebt_snat ARP重写可写漏洞 |
| CVE-2026-53198 | 8.8 HIGH | ksmbd SMB2_CANCEL双重取消导致use-after-free漏洞 |
| CVE-2026-53200 | 8.8 HIGH | KVM arm64 嵌套虚拟化 XN[0] 处理漏洞 |
显示前 20 条，共 147 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-53275
暂无评论