{"id":"CVE-2026-53011","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is call…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is call…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-06-24","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53011","references":[{"url":"https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53011.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53011"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492286"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53011"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53011"},{"url":"https://lore.kernel.org/linux-cve-announce/2026062449-CVE-2026-53011-6b0a@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:83207"},{"url":"https://access.redhat.com/errata/RHSA-2026:83156"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.0013,"epssPercentile":0.02627,"ingestedAt":"2026-07-11T17:13:40.373Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 9","10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"cwe":["CWE-825"],"scores":{"nvd":7.8,"vendor":7,"cna":7.8},"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:24:41.510503Z"},"slug":"CVE-2026-53011","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is called to promote the admin schedule to oper.\nswitch_schedules() queues the old oper schedule for RCU freeing via\ncall_rcu(), but 'next' still points into an entry of the old oper\nschedule. The subsequent 'next->end_time = end_time' and\nrcu_assign_pointer(q->current_entry, next) are use-after-free.\n\nFix this by selecting 'next' from the new oper schedule immediately\nafter switch_schedules(), and using its pre-calculated end_time.\nsetup_first_end_time() sets the first entry's end_time to\nbase_time + interval when the schedule is installed, so the value\nis already correct.\n\nThe deleted 'end_time = sched_base_time(admin)' assignment was also\nharmful independently: it would overwrite the new first entry's\npre-calculated end_time with just base_time.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:83207** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83207)\n- **RHSA-2026:83156** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83156)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53011.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}