CVE-2026-53270

ipvs: clear the svc scheduler ptr early on edit

HIGH
7.8
CVSS Score
Published: June 25, 2026 at 08:39 AM UTC
Updated: October 19, 2026 at 08:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks. Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.18.23 ≤ v < 3.194.1.11 ≤ v < 4.24.2.1 ≤ v < 5.10.2595.11 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.366.19 ≤ v < 7.0.136.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.943.18.234.1.114.24.2 rc54.2 rc64.2 rc74.2 rc84ec8fb23158797affae7993c15beba080488482f5f505a89acd21f5d0d20f5797dfbc4cf852437.17.1 rc17.1 rc27.1 rc37.1 rc47.1 rc57.1 rc6c803fddd2a95a70873c68dbff42d4c59fd2e674e
Vendor states this is fixed in 14e4689c113b4c06af1069364ade24fdd7055f33 (fixed)
Vendor states this is fixed in 193989cc6d80dd8e0460fb3992e69fa03bf0ff9b (fixed)
Vendor states this is fixed in 19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03 (fixed)
Vendor states this is fixed in 25918720ba97f974a4f8d433b5a0132c5b43f6f3 (fixed)
Vendor states this is fixed in 7d4f5004511757e3984901ffb412fcf858d80ed5 (fixed)
Vendor states this is fixed in c6376b9b1b4d2bad638256b1b3588e073344ae69 (fixed)
Vendor states this is fixed in d10730a1f2caf08088e0db1b19b242f3e6fa5f06 (fixed)
Vendor states this is fixed in e4feec3174036ba772006be74beee0efa09a9eb8 (fixed)
Affected range stops below 3.19, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 4.2 (unaffected)
Vendor states this is fixed in 5.10.259 (unaffected)
Vendor states this is fixed in 5.15.210 (unaffected)
Vendor states this is fixed in 6.1.176 (unaffected)
Vendor states this is fixed in 6.12.94 (unaffected)
Vendor states this is fixed in 6.18.36 (unaffected)
Vendor states this is fixed in 6.6.143 (unaffected)
Vendor states this is fixed in 7.0.13 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card