Linux Kernel Vulnerability in Request Socket Handling by Google

CVE-2026-53260

What is CVE-2026-53260?

A vulnerability has been identified in the Linux kernel related to request socket handling, which may allow for reference count underflows. The issue arises when the reqsk_queue_hash_req() function is preempted after modifying a timer, resulting in improper reference counting. This can lead to unexpected behavior in socket management during network operations, particularly under high traffic or specific timing conditions. Mitigation involves implementing preempt_disable_nested() and preempt_enable_nested() functions to ensure proper order of operations and prevent the vulnerability from being exploited.

References