CVE-2026-53259

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: anycast: insert aca into global hash under idev->lock

syzbot reported a splat [1]: a slab-use-after-free in

ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash

under RCU and dereferences a struct ifacaddr6 that has already been

freed while still linked in the hash, so a later reader walks into a

dangling node.

In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then

aca_get() bumps it to 2 to keep it alive across the unlocked region.

It is published to idev->ac_list under idev->lock, but

ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent

teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL)

can slip into that window:

CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL)

------------------------------ ------------------------------------

aca_alloc() refcnt 1

aca_get() refcnt 2

write_lock_bh(idev->lock)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References