CVE-2026-53233netdev: fix double-free in netdev_nl_bind_rx_doit()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() always consumes the skb. The error path calls nlmsg_free(rsp) so we can't jump directly to it. Let's not unbind, just propagate the error to the user. This is the typical way of handling genlmsg_reply() failures. They shouldn't happen unless user does something silly like calling the kernel with an already-full rcvbuf.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 170aafe35cb98e0f3fbacb446ea86389fbce22ea before e055ca9205d3eb6aec3e5fe4ecc18abbbf18c599; from 170aafe35cb98e0f3fbacb446ea86389fbce22ea before c299321bc6232770ce378d6fa6bc46004d2d7fdb; 170aafe35cb98e0f3fbacb446ea86389fbce22ea builds before 9b019376cbee10c4f9184d1745fa37d156e36f30; from 170aafe35cb98e0f3fbacb446ea86389fbce22ea before c849de7d8757a7af801fc4a4058f71d481d367f2 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.12 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; 7.1; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/e055ca9205d3eb6aec3e5fe4ecc18abbbf18c599patch
- https://git.kernel.org/stable/c/c299321bc6232770ce378d6fa6bc46004d2d7fdbpatch
- https://git.kernel.org/stable/c/9b019376cbee10c4f9184d1745fa37d156e36f30patch
- https://git.kernel.org/stable/c/c849de7d8757a7af801fc4a4058f71d481d367f2patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.