Linux kernel hisilicon/sec2: use-after-free on the request path under heavy load

Impact

The sec2 driver kept using the request object after the hardware had already completed the packet and freed it, so a loaded machine can touch freed memory on the submit path. The practical outcome is kernel memory corruption from a local workload that drives the crypto accelerator hard - crash of a node at minimum, with the usual UAF potential for privilege escalation. This only matters on hosts built on HiSilicon Kunpeng server SoCs that expose the SEC2 engine; on an x86 or NVIDIA-based GPU node the driver is not present and the CVE is irrelevant. Note that the NVD vector says AV:N; the described defect is reached by local work submitted to the accelerator, not by a remote packet, so treat the 9.8 as unrepresentative.

Who can reach it

Local user on an affected HiSilicon platform able to submit crypto work that reaches the SEC2 engine (for example through the kernel crypto API), under enough load to race hardware completion. No authentication beyond local access.

What to do

Take the stable kernel fix (the linked git.kernel.org commits replace the freed req with the longer-lived qp_ctx) and reboot each affected node; there is no runtime mitigation short of not using the SEC2 accelerator. Fleets without HiSilicon accelerators need no action. The record names no vendor-fixed version beyond the stable commits.

References

Related entries

• Linux kernel (net/rds): If RDS/IB queue-pair setup fails after the send ring is allocated but before the receive ringCVE-2026-53355 · Linux kernel (net/rds)Critical
• Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pagesCVE-2026-53363 · Linux kernel (net/xfrm)Critical
• Linux kernel nfsd: dangling IDR entry to freed layout stateid when nfsd4_layout_setlease() failsCVE-2026-53399 · Linux kernel nfsd (pNFS layout stateid teardown on setlease failure)Critical
• Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCVE-2026-63886 · Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCritical
• Linux kernel LIO iSCSI target: unbounded sprintf into the 8 KiB login response buffer overflows the heapCVE-2026-63887 · Linux kernel LIO iSCSI target (iscsi_encode_text_output login response buffer)Critical
• Linux kernel LIO iSCSI target: four-byte overread and text_in_ptr double-free in the Text PDU handlerCVE-2026-63888 · Linux kernel LIO iSCSI target (iscsit_handle_text_cmd DataDigest and text_in_ptr handling)Critical