---
cve: "CVE-2026-53227"
severity: "LOW"
cvss: 3.1
epss: "13%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-25 09:16:40"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T07:48:28+02:00"
---

# CVE-2026-53227

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix possible kfree_skb of ERR_PTR

After the patch in the "Fixes" tag, the allocation of the "reply" skb
can happen either before or after locking the ovs_mutex.

However, error cleanups still follow the classical reversed order,
assuming "reply" is allocated before locking: it is freed after unlocking.

If "reply" allocation happens after locking the mutex and it fails,
"reply" is left with an ERR_PTR, and execution jumps to the correspondent
cleanup stage which will try to free an invalid pointer.

Fix this by setting the pointer to NULL after having saved its error
value.

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.259
- Kernel ≥ 5.15.210
- Kernel ≥ 6.1.176
- Kernel ≥ 6.6.143
- Kernel ≥ 6.12.94
- Kernel ≥ 6.18.36
- Kernel ≥ 7.0.13

## Referenzen

- <https://git.kernel.org/stable/c/e248fb2e680deb2bd37bac551b72638fe4938a76>
- <https://git.kernel.org/stable/c/0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d>
- <https://git.kernel.org/stable/c/971b1b37774f13acc5add0a2843f8598446b8598>
- <https://git.kernel.org/stable/c/25fdf53698535fe8790237f5a8a9626791429785>
- <https://git.kernel.org/stable/c/e3d509a1b71396e1452060dbf84a805fd1c3c549>
- <https://git.kernel.org/stable/c/ecc55aad3390129a87106841f4b68bf3d70c9264>
- <https://git.kernel.org/stable/c/895d1dd9057cde1687fa0f4286d47ceed0b82997>
- <https://git.kernel.org/stable/c/ee30dd2909d8b98619f4341c70ec8dc8e155ab02>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-53227) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_