CVE-2026-53055: crypto: hisilicon/sec2 - prevent req used-after-free for sec

Synopsis

A use-after-free vulnerability exists in the Linux kernel's HiSilicon SEC2 crypto driver (hisilicon/sec2). The flaw is reachable over the network without any authentication or user interaction, and arises when heavy system load causes hardware to free a request buffer before the transmission function completes, leaving a dangling pointer the software then accesses. Successful exploitation gives an attacker full read, write, and crash capabilities on the affected system. Patched-image rebuilds at fix versions 6.18.33, 7.0.10, and 7.1 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network (AV:N), meaning an attacker must be able to send traffic to the exposed service to trigger the race condition.

• AuthenticationNot required

  No credentials are needed (PR:N); an unauthenticated attacker can attempt exploitation directly.

• Victim interactionNot required

  No user or administrator action is required to trigger the flaw (UI:N); the attacker does not rely on social engineering.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is reliable and does not depend on specific memory layouts, race-window timing beyond the load condition described, or other environmental prerequisites.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing cryptographic key material, session tokens, or other sensitive data processed by the SEC2 engine.
• An attacker writes to freed memory, corrupting kernel data structures and enabling privilege escalation or arbitrary code execution in kernel context.
• The use-after-free can crash the kernel outright, taking down the host and all containers running on it.
• Any workload relying on the HiSilicon SEC2 hardware crypto offload path loses availability until the system is recovered.