CVE-2026-53355

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53355", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.400Z", "datePublished": "2026-07-01T13:32:30.831Z", "dateUpdated": "2026-08-05T12:35:04.534Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:35:04.534Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable RDS/IB setup path is reachable by a remote RDMA/RDS peer through RDMA CM connection requests handled by the kernel listener, before any RDS-level authentication. It is also reachable locally via AF_RDS send-triggered connects, but the remote network path is the higher-severity reasonable scenario.\nAC:L - The bug is triggered when `i_recvs` allocation fails after `i_sends` was allocated, and an attacker can drive repeated connection setup/resource pressure to reach that condition. No race or victim-controlled timing is required.\nPR:N - The incoming RDMA CM connect path requires no local account or authenticated RDS credentials. Local AF_RDS access is unprivileged in the initial network namespace, but the remote path makes privileges none.\nUI:N - No victim user action is needed once the RDS/IB listener is present. Connection setup and teardown are handled by kernel workqueues/CM callbacks.\nS:U - The corruption occurs inside the host kernel RDS/IB connection state and does not cross a separate security authority such as a guest-host or IOMMU boundary. This is standard kernel compromise/DoS scope.\nC:H - The stale `i_sends` pointer creates a use-after-free/double-free of kernel memory and the teardown path reads the freed send ring. Under the required high-severity assumption for UAF-style memory corruption, this can support kernel memory disclosure.\nI:H - The same stale-pointer/double-free condition can corrupt kernel allocator state or operate on attacker-reused freed memory. As kernel memory corruption, it is defensibly scored as capable of arbitrary write/control-flow impact.\nA:H - At minimum, the later shutdown pass can dereference and free an already freed kernel allocation, causing an oops, panic, or allocator corruption. Repeated unauthenticated connection attempts can therefore crash or destabilize the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/ib_cm.c"], "versions": [{"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "29d940026dce39e3018dab6f67c9427249321270", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc", "status": "affected", "versionType": "git"}, {"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "lessThan": "20cf0fb715c41111469577e85e35d15f099473e0", "status": "affected", "versionType": "git"}, {"version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426", "status": "affected", "versionType": "git"}, {"version": "c9459693fae9a1bf3f51f3db98617f694112e897", "status": "affected", "versionType": "git"}, {"version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45", "status": "affected", "versionType": "git"}, {"version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c", "status": "affected", "versionType": "git"}, {"version": "3.18.74", "lessThan": "3.19", "status": "affected", "versionType": "semver"}, {"version": "4.1.46", "lessThan": "4.2", "status": "affected", "versionType": "semver"}, {"version": "4.4.91", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.54", "lessThan": "4.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/ib_cm.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.74"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.54"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"}, {"url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"}, {"url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"}, {"url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"}, {"url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"}, {"url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"}, {"url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"}, {"url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"}], "title": "net: rds: clear i_sends on setup unwind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/ib_cm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "29d940026dce39e3018dab6f67c9427249321270", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"lessThan": "20cf0fb715c41111469577e85e35d15f099473e0", "status": "affected", "version": "3b12f73a5c2977153f28a224392fd4729b50d1dc", "versionType": "git"}, {"status": "affected", "version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426", "versionType": "git"}, {"status": "affected", "version": "c9459693fae9a1bf3f51f3db98617f694112e897", "versionType": "git"}, {"status": "affected", "version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45", "versionType": "git"}, {"status": "affected", "version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c", "versionType": "git"}, {"lessThan": "3.19", "status": "affected", "version": "3.18.74", "versionType": "semver"}, {"lessThan": "4.2", "status": "affected", "version": "4.1.46", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.91", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.54", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/ib_cm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF17A38-41B0-44A8-9AA7-59F934468699", "versionEndExcluding": "3.19", "versionStartIncluding": "3.18.74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD7B43DB-D99B-4203-84D2-00416A5FC499", "versionEndExcluding": "4.2", "versionStartIncluding": "4.1.46", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E470178B-3110-4B83-8604-3F2FECD775D9", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.91", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "77BE86A0-6550-4518-835F-C6792092720A", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.54", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5678E1DD-11E1-4E0E-8B6F-A6A6ED57FE8A", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:-:*:*:*:*:*:*", "matchCriteriaId": "623D643F-123E-4D3E-8CBF-16BF845D734B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "64F78CCF-F54B-4D1C-AFA6-DE4076C3A263", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "A659506C-868E-4E87-B0D8-E901BC2E9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "ACE2C8C3-F2AA-4A39-9D81-B0F8BB82B834", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "D67BFFD0-1A52-4F5D-98DB-D94B58FD8D30", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc7:*:*:*:*:*:*", "matchCriteriaId": "7D996F38-22AC-4059-84FC-F7D69CE0CB9B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc8:*:*:*:*:*:*", "matchCriteriaId": "97EFF4F7-E5F9-4FAA-AD58-94A24501AD59", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."}], "id": "CVE-2026-53355", "lastModified": "2026-07-22T19:14:36.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-01T14:16:43.790", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: rds: clear i_sends on setup unwind", "id": "2495942", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495942"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) over InfiniBand (IB) connection teardown process. When the rds_ib_setup_qp() function fails to set up a connection, it may free a memory allocation (i_sends) without properly clearing the associated pointer. This can lead to a stale pointer being used in a subsequent shutdown operation, potentially causing incorrect memory access and system instability or a denial of service."], "name": "CVE-2026-53355", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53355\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53355\nhttps://lore.kernel.org/linux-cve-announce/2026070147-CVE-2026-53355-c555@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,66cccec111421a10efdc2c74499d15b93e7acae5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,29d940026dce39e3018dab6f67c9427249321270)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,e7cf30aa5f1fc6c2a86df65df8b731df20e44d79)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,1d4ec754ee3871f7e3670c67bb0298c9c5760926)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,27040bbca289a704eafcacca167d310c6ce2b1bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b12f73a5c2977153f28a224392fd4729b50d1dc,20cf0fb715c41111469577e85e35d15f099473e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "75a12b2fa80c2e4cc40a9f9305f95899850b7426"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c9459693fae9a1bf3f51f3db98617f694112e897"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.74,3.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.46,4.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.91,4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.54,4.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-01T15:00:06.692972+00:00", "updated": "2026-08-12T09:45:01.484499+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}