CVE-2026-53055
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In the Linux kernel's hisilicon/sec2 driver, a use-after-free vulnerability was found during packet transmission. Under heavy system load, hardware may complete packet processing and free the request memory (req) before the transmission function finishes, causing an error.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to kernel memory, potentially leading to privilege escalation or system crash.
Recommendation
Immediately update the Linux kernel to a version containing the fix that replaces req access with qp_ctx, eliminating the use-after-free risk.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx.