CVE-2026-53270

Estado: AnalizadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear the svc scheduler ptr early on edit

ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period.

Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks.

Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.12%
Percentil entre todas las CVEs puntuadas: 2
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1499.004 Application or System Exploitationimpact75 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact60 %

Vulnerabilidad local con PR:L sin interacción (T1068). Acceso post-RCU a datos liberados causa DoS (T1499.004) o corrupción de datos de scheduler (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Restrict File and Directory Permissions Remote Data Storage Filter Network Traffic Execution Prevention Encrypt Sensitive Information

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-53270",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "e4feec3174036ba772006be74beee0efa09a9eb8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "7d4f5004511757e3984901ffb412fcf858d80ed5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "c6376b9b1b4d2bad638256b1b3588e073344ae69",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "14e4689c113b4c06af1069364ade24fdd7055f33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "25918720ba97f974a4f8d433b5a0132c5b43f6f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c803fddd2a95a70873c68dbff42d4c59fd2e674e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ec8fb23158797affae7993c15beba080488482f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3.18.23",
              "lessThan": "3.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.11",
              "lessThan": "4.2",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-25T09:16:45.123",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc->scheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc->sched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code."
    }
  ],
  "lastModified": "2026-07-08T04:01:44.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFEB996F-37AA-4FE9-9E1E-7158BD2B7CA9",
              "versionEndExcluding": "3.19",
              "versionStartIncluding": "3.18.23"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CD6E092-00BA-470A-BD6E-9FF38E84DB99",
              "versionEndExcluding": "4.2",
              "versionStartIncluding": "4.1.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9B3AA9-A2A9-4ABB-81A1-0E8F0D3F770D",
              "versionEndExcluding": "5.10.259",
              "versionStartIncluding": "4.2.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
              "versionEndExcluding": "5.15.210",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
              "versionEndExcluding": "6.12.94",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
              "versionEndExcluding": "6.18.36",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
              "versionEndExcluding": "7.0.13",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37D5F2FA-B7D0-4F9D-BC97-F450E5839C7B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130E1C2A-45DE-4C16-8FFA-06E9C9F7F175"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78F0CC21-E28A-4B83-B65B-94AB9242F345"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AED16DC6-6364-4B57-92A1-F14F347DADF7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03A4BCF1-5A7D-4E74-948F-134F0E57D73B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}