# CVE-2026-53259: kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under... CVE-2026-53259 is fixed in 50 products on 1 platform, first by DEBIAN-CVE-2026-53259, released June 28, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-53259 - Priority: High - CVSS: 7.8 (moderate) - EPSS: 0.0012 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 25, 2026 ## Description In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node. In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window: CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL) ------------------------------ ------------------------------------ aca_alloc() refcnt 1 aca_get() refcnt 2 write_lock_bh(idev->lock) add aca to ac_list write_unlock_bh(idev->lock) write_lock_bh(idev->lock) pull aca off ac_list write_unlock_bh(idev->lock) ipv6_del_acaddr_hash(aca) hlist_del_init_rcu() is a no-op, aca is not in the hash yet aca_put() refcnt 2->1 ipv6_add_acaddr_hash(aca) aca now inserted into the hash aca_put() refcnt 1->0 call_rcu(aca_free_rcu) -> kfree(aca) The hash removal becomes a no-op because the insertion has not happened yet, so once CPU0 inserts and drops the last reference, the aca is freed while still linked in inet6_acaddr_lst[], and readers dereference freed memory after the slab slot is reused. This window opened once RTNL stopped serializing the join path against device teardown. Move ipv6_add_acaddr_hash() inside the idev->lock section so the ac_list and hash insertions are atomic with respect to teardown: a racing remover now either misses the aca entirely or finds it in both lists. acaddr_hash_lock is now nested under idev->lock, which is acquired in softirq context, so switch all acaddr_hash_lock sites to spin_lock_bh() to avoid the irq lock inversion reported in [2]. [1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a [2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/ ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.18 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | bpftool6.18-debuginfo amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel RHEL 10 | 6.12.0-211.52.1.el10_2 | [RHSA-2026:64775](https://patchblox.com/security/data/fix/linux/rhsa-2026-64775.md) | Aug 6, 2026 | | Linux | kernel ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel rocky 10 | 0:6.12.0-211.52.1.el10_2 | [RLSA-2026:64775](https://patchblox.com/security/data/fix/linux/rlsa-2026-64775.md) | Sep 9, 2026 | | Linux | kernel-abi-stablelists ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-core ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-cross-headers ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-core ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-devel ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-devel-matched ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-modules ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-modules-core ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-modules-extra ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-debug-uki-virt ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-devel ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-devel-matched ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-doc ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-headers ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-livepatch-6.18.36-69.134 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel-modules ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-modules-core ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-modules-extra ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-modules-extra-matched ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-tools ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-tools-libs ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-tools-libs-devel ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-uki-virt ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel-uki-virt-addons ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | kernel6.18 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-debuginfo amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-debuginfo-common-aarch64 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-debuginfo-common-x86_64 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-devel amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-headers amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-modules-extra amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-modules-extra-common amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-tools amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-tools-debuginfo amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | kernel6.18-tools-devel amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | libperf ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | linux Debian 14 | 7.0.13-1 | [DEBIAN-CVE-2026-53259](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53259.md) | Jun 28, 2026 | | Linux | microvm-kernel6.18 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | perf ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | perf6.18 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | perf6.18-debuginfo amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | python3-perf ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | python3-perf6.18 amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | python3-perf6.18-debuginfo amzn 2023 | 1:6.18.36-69.134.amzn2023 | [ALAS2023-2026-1925](https://patchblox.com/security/data/fix/linux/alas2023-2026-1925.md) | Jul 6, 2026 | | Linux | rtla ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | | Linux | rv ol 10 | 0:6.12.0-211.53.1.el10_2 | [ELSA-2026-64775-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64775-0.md) | Sep 10, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.