CVE-2026-53011

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel Taprio Scheduler

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->end_time = end_time' and rcu_assign_pointer(q->current_entry, next) are use-after-free. Fix this by selecting 'next' from the new oper schedule immediately after switch_schedules(), and using its pre-calculated end_time. setup_first_end_time() sets the first entry's end_time to base_time + interval when the schedule is installed, so the value is already correct. The deleted 'end_time = sched_base_time(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated end_time with just base_time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53011

EUVD

EUVD-2026-38879

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.2 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the use-after-free issue in the taprio scheduler code. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Identify your current Linux kernel version.
Check for available kernel updates from your distribution or kernel provider.
Apply the kernel update that contains the fix for CVE-2026-53011.
Reboot the system to load the updated kernel.

Executive Summary

This vulnerability is a use-after-free bug in the Linux kernel's network scheduler component called taprio, specifically in the advance_sched() function during a schedule switch.

When the function should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to operational. However, switch_schedules() queues the old operational schedule for deferred freeing, but a pointer named 'next' still references an entry in the old schedule.

Subsequent operations use this 'next' pointer after the old schedule has been freed, causing a use-after-free condition. The fix involves selecting 'next' from the new operational schedule immediately after switching schedules and using its pre-calculated end_time to avoid accessing freed memory.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as system crashes, memory corruption, or potential escalation of privileges if exploited.

Because it occurs in the network scheduler, it might be triggered during network traffic scheduling operations, potentially affecting system stability and reliability.

Hi! I’m here to help you understand CVE-2026-53011. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70