CVE-2026-53156

A flaw was found in the Linux kernel's nvmem core. This vulnerability, a use-after-free, occurs in error handling paths where memory associated with an nvmem device is prematurely released while the system continues to access the freed memory. This can lead to memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code.

This vulnerability is rated as Moderate severity because exploitation requires local access and relies on triggering uncommon hardware or driver initialization error conditions to cause a denial of service. The flaw resides within the core non-volatile memory (NVMEM) subsystem of the Linux kernel, where reference management errors during failure states can result in a crash rather than arbitrary privilege escalation under typical operating environments. Because standard enterprise deployments do not expose these specialized error flows to unauthenticated or remote users, the overall security risk remains constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.