CVE-2026-53156CWE-416

CVE-2026-53156

High · published June 25, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
2.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvmem: core: fix use-after-free bugs in error paths

Fix several instances of error paths in which we call

__nvmem_device_put() - which may end up freeing the underlying memory

and other resources - and then keep on using the nvmem structure. Always

put the reference to the nvmem device as the last step before returning

the error code.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00125 · 2.0th percentile
Weakness
CWE-416 · Use After Free
Published
2026-06-25T13:16Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 4.20, < 6.12.946.12.94
linux/linux_kernel≥ 6.13, < 6.18.366.18.36
linux/linux_kernel≥ 6.19, < 7.0.137.0.13
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/40e2a459c0dd1333b2343831480a0ad80dc07614 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6cdcf0d16c80900f42d60252480cd131c1a83d23 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 25 JUN 08:38Z
    nvmem: core: fix use-after-free bugs in error paths
    cvelistv5