In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8660-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - x86 architecture;

    - InfiniBand drivers;

    - Network drivers;

    - Network traffic control;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - Open vSwitch;

    - RxRPC session sockets;

    - SCTP protocol; (CVE-2026-46331, CVE-2026-52924, CVE-2026-53131, CVE-2026-53151, CVE-2026-53175,     CVE-2026-53176, CVE-2026-53186, CVE-2026-53212, CVE-2026-53215, CVE-2026-53216, CVE-2026-53221,     CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260,     CVE-2026-53359, CVE-2026-64531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit()     walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using     inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set     INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The     queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue     lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier     and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the     queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail.
    inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes
    ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the     same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in     inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes     after the flush and takes the queue lock then finds an empty queue and starts a new run instead of     dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush,     so drop the now duplicate code there. (CVE-2026-53175)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
340044	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8660-1)	Nessus	Ubuntu Local Security Checks	Local	critical
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
327383	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	Local	high
323386	Linux Distros Unpatched Vulnerability : CVE-2026-53175	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53175

high

Tenable Plugins

high

high

high

critical

high

high

high