# CVE-2026-6424: ESET Linux products use-after-free causing kernel panic

Source: https://junglewise.ai/threats/cve-2026-6424-eset-linux-products-use-after-free-causing-kernel-panic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-6424 · Severity: info · CVSS 6.7 · Published 2026-07-16

A vulnerability in ESET security software for Linux could allow an attacker with high-level system access to crash the computer. By triggering a specific sequence of system commands, the attacker can cause a 'kernel panic,' which immediately shuts down the server or workstation. This results in a complete service outage (denial-of-service) until the system is manually restarted.

Vendors: [Eset](https://junglewise.ai/threats/vendors/eset).

## Quick answers

**Is CVE-2026-6424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6424 being exploited in the wild.

**How severe is CVE-2026-6424?** Informational severity, with a CVSS score of 6.7, published 16 July 2026.

**Which products and versions are affected?** Eset Endpoint Antivirus for Linux 12.0.13.0 and earlier, 12.1.1.0 and earlier, 12.2.8.0 and earlier, 13.0.3.0 and earlier, 13.1.3.0 and earlier; Eset Server Security for Linux 12.0.287.0 and earlier, 12.1.406.0 and earlier, 12.2.72.0 and earlier, 13.0.34.0 and earlier, 13.1.116.0 and earlier.

**Is there a fix for CVE-2026-6424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6424 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-6424?** Check whether you run Eset Endpoint Antivirus for Linux or Eset Server Security for Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in ESET Endpoint Antivirus and Server Security for Linux (CWE-416). The flaw is triggered when a long-running syscall causes the product to access memory pages that have already been released. An attacker with high privileges (PR:H) can exploit this timing-sensitive condition locally to induce a kernel panic, leading to a complete system crash (Denial of Service). The issue has been resolved in multiple version branches, including Endpoint Antivirus 13.2.3.0+ and Server Security 13.2.53.0+.

## Affected products

- ESET ESET Endpoint Antivirus for Linux 12.0.13.0 and earlier, 12.1.1.0 and earlier, 12.2.8.0 and earlier, 13.0.3.0 and earlier, 13.1.3.0 and earlier
- ESET ESET Server Security for Linux 12.0.287.0 and earlier, 12.1.406.0 and earlier, 12.2.72.0 and earlier, 13.0.34.0 and earlier, 13.1.116.0 and earlier

## Timeline

- 2026-07-15: advisory: Initial advisory published by ESET (CA8972)
- 2026-07-16: disclosed: CVE-2026-6424 published to NVD

## References

- [https://support.eset.com/en/ca8972-eset-customer-advisory-use-after-free-vulnerability-in-eset-security-products-for-linux-fixed](https://support.eset.com/en/ca8972-eset-customer-advisory-use-after-free-vulnerability-in-eset-security-products-for-linux-fixed)