CVE-2026-53251: linux
CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-53251DEBIAN-CVE-2026-53251CGA-3x75-jgc6-9rfcCGA-42mw-mrpx-m98xCGA-6rjh-jjcg-5jv4CGA-gcp5-mf2q-wpqmCGA-hr88-3v5g-rcqvCGA-xf2v-8qr8-g22g
Published 25-06-2026Last modified 25-06-2026
Vulnerability summary
CVE-2026-53251 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.12%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 24 · Related 24MGASA-2026-0312OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23237-1USN-8726-1USN-8726-2USN-8726-3USN-8726-4USN-8727-1USN-8728-1USN-8728-2USN-8728-3USN-8760-1USN-8760-2USN-8800-1USN-8903-1USN-8903-2USN-8904-1USN-8905-1USN-8905-2USN-8906-1CGA-PFH4-493R-7GRQ
Timeline
- 25-06-2026PublishedVulnerability first disclosed.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync hci_get_route() returns a reference-counted hci_dev pointer via hci_dev_hold(). The function exits normally or with an error without ever releasing it.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.7Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
-0.04 pp
From 0.16% on 19-09-2026
19-09-202619-10-2026
EPSS score0.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu141 products
- linux< 6.8.0-146.146 | All versions (No fix recorded) | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1066.69 | All versions (No fix recorded) | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard6 products
- linux-azure-6.18< 6.18.38-r0
- linux-gcp-6.18< 6.18.38-r0
- linux-gcp-6.18-bootc-boot-installed< 6.18.38-r0
- linux-qemu-6.18< 6.18.38-r0
- linux-qemu-6.18-bootc-boot-installed< 6.18.38-r0
Linux2 products
- linux≥ 1360e5b6ce63d63d23223a659ca2bbafa30a53aa, < 4bbec25f47b930101294fd310c627c3f53e9661f | ≥ 07a9342b94a91b306ed1cf6aa8254aea210764c9, < 33d677d2e3713d98012c3dbd4a9207f7d785b854 | ≥ 07a9342b94a91b306ed1cf6aa8254aea210764c9, < 23e8eb16820b866528fb300dc67fe3f67f00ef62 | ≥ 07a9342b94a91b306ed1cf6aa8254aea210764c9, < 5cbf290b79351971f20c7a533247e8d58a3f970c | bfec1e55314896bf4a4cfdb3a9ad4872be9f06ed | ≥ 6.12.2, < 6.12.94 | ≥ 6.11.11, < 6.12 | 6.13
- linux_kernel≥ 6.11.11, < 6.12 | ≥ 6.12.2, < 6.12.94 | ≥ 6.13, < 6.18.36 | ≥ 6.19, < 7.0.13 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5 | 7.1:rc6
Debian1 product
- linux< 6.12.94-1 | < 7.0.13-1
4 vendors · 150 products
