CVE-2026-53055
This vulnerability is a use‑after‑free bug in the Linux kernel’s hisilicon/sec2 crypto driver. It can allow an attacker to crash the system or potentially execute arbitrary code when the kernel processes packets under heavy load. The flaw is critical because it can affect all systems running the affected kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users running a version that contains the hisilicon/sec2 crypto driver before the fix. This includes many embedded devices and servers that use the affected kernel.
Real-world impact
An attacker could crash the system or potentially run arbitrary code, leading to denial of service or full compromise of the affected machine.
Why this severity
The CVSS score of 9.8 reflects the lack of authentication or user interaction required, the high impact on confidentiality, integrity, and availability, and the fact that the flaw can be triggered by simply sending packets to the system.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2026-53055.
NVD description
Timeline
- Jun 24, 2026 · Jun 24, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.