{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().\\n\\nsyzbot reported a weird reqsk-\\u003ersk_refcnt underflow in\\n__inet_csk_reqsk_queue_drop().\\n\\nThe captured reqsk_put() in __inet_csk_reqsk_queue_drop()\\nis called only when it successfully removes reqsk from ehash.\\n\\nMoreover, reqsk_timer_handler() calls another reqsk_put()\\nafter that.\\n\\nThis indicates that the reqsk was missing both refcnts for\\nehash and the timer itself.\\n\\nSince all the syzbot reports had PREEMPT_RT enabled, the only\\npossible scenario is that reqsk_queue_hash_req() is preempted\\nafter mod_timer() and before refcount_set(), and then the timer\\ntriggered after 1s aborts the reqsk due to its listener’s close().\\n\\nLet’s wrap mod_timer() and refcount_set() with\\npreempt_disable_nested() and preempt_enable_nested().\\n\\nNote that inet_ehash_insert() holds the normal spin_lock()\\n(mutex in PREEMPT_RT), so it must be called outside of\\npreempt_disable_nested(), but this is fine.\\n\\nThe lookup path just ignores 0 sk_refcnt entries in ehash\\nand tries to create another reqsk, but this will fail at\\ninet_ehash_insert().\\n\\n[0]:\\nrefcount_t: underflow; use-after-free.\\nWARNING: lib\/refcount.c:28 at refcount_warn_saturate+0xb2\/0x110 lib\/refcount.c:28, CPU#0: ktimers\/0\/16\\nModules linked in:\\nCPU: 0 UID: 0 PID: 16 Comm: ktimers\/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}\\nTainted: [L]=SOFTLOCKUP\\nHardware name: Google Google Compute Engine\/Google Compute Engine, BIOS Google 04\/18\/2026\\nRIP: 0010:refcount_warn_saturate+0xb2\/0x110 lib\/refcount.c:28\\nCode: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a \\u003c67\\u003e 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f\\nRSP: 0000:ffffc90000157948 EFLAGS: 00010246\\nRAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000\\nRDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00\\nRBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005\\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568\\nR13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000\\nFS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0\\nCall Trace:\\n \\u003cTASK\\u003e\\n __refcount_sub_and_test include\/linux\/refcount.h:400 [inline]\\n __refcount_dec_and_test include\/linux\/refcount.h:432 [inline]\\n refcount_dec_and_test include\/linux\/refcount.h:450 [inline]\\n reqsk_put include\/net\/request_sock.h:136 [inline]\\n __inet_csk_reqsk_queue_drop+0x3ce\/0x440 net\/ipv4\/inet_connection_sock.c:1007\\n reqsk_timer_handler+0x651\/0xdf0 net\/ipv4\/inet_connection_sock.c:1137\\n call_timer_fn+0x192\/0x5e0 kernel\/time\/timer.c:1748\\n expire_timers kernel\/time\/timer.c:1799 [inline]\\n __run_timers kernel\/time\/timer.c:2374 [inline]\\n __run_timer_base+0x6a3\/0x9f0 kernel\/time\/timer.c:2386\\n run_timer_base kernel\/time\/timer.c:2395 [inline]\\n run_timer_softirq+0x67\/0x170 kernel\/time\/timer.c:2403\\n handle_softirqs+0x1de\/0x6d0 kernel\/softirq.c:622\\n __do_softirq kernel\/softirq.c:656 [inline]\\n run_ktimerd+0x69\/0x100 kernel\/softirq.c:1151\\n smpboot_thread_fn+0x541\/0xa50 kernel\/smpboot.c:160\\n kthread+0x388\/0x470 kernel\/kthread.c:436\\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158\\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245\\n \\u003c\/TASK\\u003e”,”published”:”2026-06-25T08:39:49.229Z”,”modified”:”2026-06-28T06:41:03.925Z”,”type”:”cve”,”title”:”tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/b183215ff714efb747d9d5a429322ba6404b5401\\nhttps:\/\/git.kernel.org\/stable\/c\/e10902df24488ca722303133acfc82490f7d59ad”,”id”:”CVE-2026-53260″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux d2d6422f8bd17c6bb205133e290625a564194496\\nLinux Linux d2d6422f8bd17c6bb205133e290625a564194496\\nLinux Linux 6.12″,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”d2d6422f8bd17c6bb205133e290625a564194496″,”vendor”:”Linux”,”ai_description”:”AI processing failed – invalid JSON response”,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().\\n\\nsyzbot reported a weird reqsk-\\u003ersk_refcnt underflow in\\n__inet_csk_reqsk_queue_drop().\\n\\nThe captured reqsk_put() in __inet_csk_reqsk_queue_drop()\\nis called…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,35,12,13,7,11,5],"class_list":["post-66529","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n