CVE-2026-53270

Status: AnalyzedHigh (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear the svc scheduler ptr early on edit

ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period.

Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks.

Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.12%
Percentile among all scored CVEs: 2
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Primary impactT1499.004 Application or System Exploitationimpact75 %
Secondary impactT1565.001 Stored Data Manipulationimpact60 %

Vulnerabilidad local con PR:L sin interacción (T1068). Acceso post-RCU a datos liberados causa DoS (T1499.004) o corrupción de datos de scheduler (T1565.001).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence Program Restrict File and Directory Permissions Remote Data Storage Filter Network Traffic Execution Prevention Encrypt Sensitive Information

Affected technologies (1)

Linux — Linux Kernel

CWEs

NVD-CWE-noinfo

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-53270",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "e4feec3174036ba772006be74beee0efa09a9eb8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "7d4f5004511757e3984901ffb412fcf858d80ed5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "c6376b9b1b4d2bad638256b1b3588e073344ae69",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "14e4689c113b4c06af1069364ade24fdd7055f33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "25918720ba97f974a4f8d433b5a0132c5b43f6f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "lessThan": "193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c803fddd2a95a70873c68dbff42d4c59fd2e674e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ec8fb23158797affae7993c15beba080488482f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3.18.23",
              "lessThan": "3.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.11",
              "lessThan": "4.2",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-25T09:16:45.123",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc->scheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc->sched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code."
    }
  ],
  "lastModified": "2026-07-08T04:01:44.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFEB996F-37AA-4FE9-9E1E-7158BD2B7CA9",
              "versionEndExcluding": "3.19",
              "versionStartIncluding": "3.18.23"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CD6E092-00BA-470A-BD6E-9FF38E84DB99",
              "versionEndExcluding": "4.2",
              "versionStartIncluding": "4.1.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9B3AA9-A2A9-4ABB-81A1-0E8F0D3F770D",
              "versionEndExcluding": "5.10.259",
              "versionStartIncluding": "4.2.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
              "versionEndExcluding": "5.15.210",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
              "versionEndExcluding": "6.12.94",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
              "versionEndExcluding": "6.18.36",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
              "versionEndExcluding": "7.0.13",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37D5F2FA-B7D0-4F9D-BC97-F450E5839C7B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130E1C2A-45DE-4C16-8FFA-06E9C9F7F175"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78F0CC21-E28A-4B83-B65B-94AB9242F345"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AED16DC6-6364-4B57-92A1-F14F347DADF7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.2:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03A4BCF1-5A7D-4E74-948F-134F0E57D73B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}