Riskcovery

CVE-2026-53055

crypto: hisilicon/sec2 - prevent req used-after-free for sec

State
Published
Severity
9.8 Critical
Published
Jun 24, 2026
Updated
Aug 5, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: hisilicon/sec2 - prevent req used-after-free for sec

During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f0ae287c50455f7be0d8dd45a803d403c7aa4d2e to before b375c3c7209cc59e40e97998aa9bc768369cca0eAffected
  • f0ae287c50455f7be0d8dd45a803d403c7aa4d2e to before ad73563f3a1edbfddf2724136c6a15826b354e18Affected
  • f0ae287c50455f7be0d8dd45a803d403c7aa4d2e to before 67b53a660e6bf0da2fa8d8872e897a14d8059eafAffected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.33 through 6.18.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.