Contact us
Articles › Security Advisories

Mitigating CVE-2026-53361 and CVE-2026-72137 on Rocky Linux and LTS Variants

cvesecuritykernelrocky linuxmitigationnetworking

Stephen Simpson
Senior Customer Support Engineer

Sep 01, 2026

Introduction

CVE-2026-53361 and CVE-2026-72137 are two Linux kernel flaws in the networking stack. Both carry an Important severity rating, both have a local attack vector, and both have public exploit code available. Among CIQ maintained kernels, only RLC Pro 10 is affected, and a single kernel update is expected to address both.

CVE-2026-53361, publicly referred to as BadGarbage, is a race condition in the af_unix garbage collector. unix_schedule_gc() set the gc_in_progress flag rather than unix_gc() itself, so two concurrent callers could leave the flag false while collection was still running. unix_peek_fpl() relies on that flag to avoid confusing the collector during MSG_PEEK. Public exploit code demonstrates a use-after-free leading to local privilege escalation and container escape.

CVE-2026-72137 is a double free in the xfrm NAT keepalive path. nat_keepalive_send() freed the keepalive skb on any error from the IPv4 or IPv6 send helper, but once ip_build_and_send_pkt() or ip6_xmit() has taken ownership the networking stack may already have consumed the buffer. Freeing it a second time corrupts kernel memory. Public exploit code demonstrates local privilege escalation.

Problem

CVE-2026-53361 was introduced by upstream commit 8b90a9f819dc ("af_unix: Run GC on only one CPU.") and is fixed by commit d82ba05263c. CVE-2026-72137 was introduced by upstream commit f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states") and is fixed by commit 226f4a490d1. Both vulnerable code paths are recent additions to the upstream kernel, which is why older product lines are out of scope.

The following CIQ product variant is affected. Treat it as exposed until it is running a patched kernel listed in the Patched Kernels section:

  • RLC Pro 10

The following are not affected, because the vulnerable code is not present in their kernels:

  • CIQ Bridge 7.9
  • RLC Pro 8 and RLC Pro 9
  • RLC Pro LTS 8.6, LTS 9.2, and LTS 9.6

The following already carry both upstream fixes:

  • CIQ Linux Kernel LT 6.12
  • CIQ Linux Kernel 6.18

CLK builds predating those fixes are vulnerable. If you are running a CLK kernel and are unsure whether it includes the patches, open a support case to confirm the specific build.

For community Rocky Linux releases, refer to errata.rockylinux.org for patch availability.

Status

  • RLC Pro 10 is the only CIQ variant currently known to be affected.
  • No patched RLC Pro 10 kernel has been released yet. This article will be updated with the package version and release date once the build is published.
  • Public exploit code exists for both CVEs. Prioritize affected systems accordingly.
  • Both flaws require local access. Neither is remotely exploitable on its own.
  • Open a support case if you need help assessing exposure or tracking patched kernel availability.

Patched Kernels

Variant Patched Kernel Version Released
RLC Pro 10 pending pending

Confirm what is running on a given system with:

uname -r

Confirming Exposure

Exposure is determined by the installed kernel package, not by workload configuration.

An RLC Pro 10 system is affected until it runs a patched kernel. Identify the running kernel with:

uname -r

Compare that against the Patched Kernels table above. Until a patched build is published, treat all RLC Pro 10 systems as affected.

Two cautions on scoping this by configuration:

CVE-2026-53361 is in the core af_unix garbage collector, which is exercised by any workload that passes file descriptors over Unix domain sockets. There is no configuration that takes a system out of scope.

CVE-2026-72137 sends an ESP-in-UDP NAT keepalive, so it may appear that only hosts running IPsec are exposed. That is not a safe assumption. A local attacker can create the required xfrm state inside their own user and network namespace, so the absence of host IPsec configuration does not rule out exploitation. Do not use existing xfrm configuration to classify an affected system as unexposed.

Mitigation

No configuration change mitigates either flaw. The patched kernel is the resolution.

Because both flaws require local code execution, the practical interim control is limiting who and what can run code on affected hosts. Systems with interactive users, CI/CD runners, shared application accounts, multi-tenant container hosts, or any workload capable of executing untrusted code should be treated as exposed and prioritized once the patched kernel is published.

Verification

Once a patched kernel is published and installed, verify the running kernel:

uname -r

Compare the output against the Patched Kernels table above. If the running kernel matches or is newer than the patched version listed for your variant, the fixes are in place.

Resolution

  1. Watch this article for the patched RLC Pro 10 kernel version and release date
  2. Once published, update the kernel with sudo dnf update kernel*
  3. Reboot into the new kernel
  4. Verify the running kernel with uname -r

If the update does not appear after publication, run sudo dnf clean all && sudo dnf makecache to refresh repository metadata.

Notes

  • CVE-2026-53361 scores CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVE-2026-72137 scores CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The difference is attack complexity.

CVE-2026-53361 on NVD
CVE-2026-72137 on NVD
Upstream fix for CVE-2026-53361
Upstream fix for CVE-2026-72137