{
  "cveId": "CVE-2026-53240",
  "url": "https://patchblox.com/security/cve/CVE-2026-53240",
  "summary": "CVE-2026-53240 is fixed in linux on 1 platform by DEBIAN-CVE-2026-53240 (version 7.0.13-1), released June 28, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix use-after-free on first_skb in...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload  __input_process_payload() stores first_skb into xtfs-\u003Era_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs-\u003Era_newskb without the lock to decide whether first_skb is still owned:      if (first_skb \u0026\u0026 first_iplen \u0026\u0026 !defer \u0026\u0026 first_skb != xtfs-\u003Era_newskb)  Between spin_unlock and this read, a concurrent CPU running iptfs_reassem_cont() (or the drop_timer hrtimer) can complete reassembly, NULL xtfs-\u003Era_newskb, and free the skb. The check then evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb operate on the freed skb \u2014 a use-after-free in skbuff_head_cache.  Replace the unlocked read with a local bool that records whether first_skb was handed to the reassembly state in the current call. The flag is set after the existing spin_unlock, before the break, using the pointer equality that is stable at that point (first_skb == skb iff first_skb was stored in ra_newskb).",
  "published": "2026-06-25T09:16:41Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00565,
  "epssPercentile": 0.47165,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.13-1",
      "fix": "DEBIAN-CVE-2026-53240",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53240",
      "released": "2026-06-28T17:47:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}