CVE-2026-53132: linux
Vulnerability summary
CVE-2026-53132 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 31 · Related 31Timeline
- 25-06-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0)
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.14% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Ubuntu141 products
- linux< 6.8.0-146.146 | All versions (No fix recorded) | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1066.69 | All versions (No fix recorded) | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard11 products
- linux-aws-6.12< 6.12.95-r0
- linux-aws-6.18< 6.18.38-r0
- linux-azure-6.18< 6.18.38-r0
- linux-gcp-6.18< 6.18.38-r0
- linux-gcp-6.18-bootc-boot-installed< 6.18.38-r0
Linux2 products
- linux≥ 077706165717686a2a6a71405fef036cd5b37ae0, < 1eca304f97a34ed5e921e1f0e06c8b241f25bf12 | ≥ 077706165717686a2a6a71405fef036cd5b37ae0, < 9bdc637fde66b63d6cad0caacd034888bb7bf5f5 | ≥ 077706165717686a2a6a71405fef036cd5b37ae0, < 100d5b2ffdc6468b9e48532641f29e83efdcb63c | ≥ 077706165717686a2a6a71405fef036cd5b37ae0, < 059b7dbd20a6f0c539a45ddff1573cb8946685b5 | 5852a2b573f7a3a29df46296e56aa3491e589cdf | ≥ 6.1.63, < 6.2 | 6.3
- linux_kernelEOL≥ 6.1.63, < 6.2 | ≥ 6.3.1, < 6.12.94 | ≥ 6.13, < 6.18.36 | ≥ 6.19, < 7.0.13 | 6.3 | 6.3:rc3 | 6.3:rc4 | 6.3:rc5 | 6.3:rc6 | 6.3:rc7 | 7.1:rc1 | 7.1:rc2
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.94-1 | < 7.0.13-1
4 vendors · 155 products
