Skip to main content

Linux Kernel CVE-2026-45957

| EUVDEUVD-2026-32241 HIGH
Out-of-bounds Read (CWE-125)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-hmgm-22hx-5rp9
Buffer Overflow Denial Of Service Information Disclosure Linux
7.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell with tracing privileges
  2. Delivery
    Enable ftrace softirq stack-trace events
  3. Exploit
    Trigger RCU deferred-QS path under load
  4. Execution
    Recursive rcu_read_unlock_special re-entry
  5. Impact
    CPU deadloop and kernel hang (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires (1) local code execution on the target with sufficient privileges to enable kernel tracing - ftrace control via tracefs/debugfs typically demands CAP_SYS_ADMIN - and (2) the softirq tracepoint with stack-trace event enabled, plus a workload that drives rcu_read_unlock_special() down the deferred quiescent-state path (e.g., preemptible RCU with PREEMPT(full) as in the reporter's 6.18.0-rc7 reproducer). The original reproducer used an out-of-tree kernel module (my_irq_work) to trigger the path. The bug cannot be exercised remotely, requires no user interaction beyond enabling tracing, and is limited to kernels containing commit 5f5fa7ea89dc that have not yet received the fix; systems without ftrace enabled or with tracefs locked down to root-only are not realistically reachable by unprivileged users.
Impact

CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H scores 7.1 (High), but the realistic impact is local denial of service via kernel deadloop or stack exhaustion when ftrace is active - the C:H rating appears generous for what is fundamentally a softirq recursion bug with no demonstrated information-disclosure primitive. EPSS is extremely low at 0.02% (5th percentile), the CVE is NOT in CISA KEV, and no public exploit identified at time of analysis. SSVC signals are not provided. Triggering conditions require local privilege sufficient to enable kernel tracing (typically CAP_SYS_ADMIN) plus a workload that exercises deferred-QS RCU paths, making opportunistic exploitation unlikely. The CWE-125 classification conflicts with the description (no OOB read shown - this is a recursive softirq re-entry); the underlying defect is better described as uncontrolled recursion / improper state handling.
Exploit ScenarioDerived

A local user with privileges to enable kernel tracing (CAP_SYS_ADMIN, or via an out-of-tree module like the my_irq_work module shown in the warning trace) enables ftrace with the softirq raise tracepoint and stack-trace events. When the kernel next invokes rcu_read_unlock_special() under the right deferred-QS conditions, the tracer recursively re-enters the same path through raise_softirq_irqoff(), hanging the CPU and producing a system-wide denial of service. No public exploit identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Denial of service in the Linux kernel's RCU (Read-Copy-Update) subsystem allows a local condition to trigger an infinite recursion deadloop in rcu_read_unlock_special() when ftrace is enabled, leading to kernel hang or crash. The flaw stems from a missing recursion-protection flag when raise_softirq_irqoff() is invoked from the RCU unlock path, causing repeated re-entry through the softirq/trace stack. No public exploit identified at time of analysis and EPSS rates exploitation probability at 0.02%.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.128, 6.12.75, 6.18.14, or 6.19.4 (or newer) depending on your stable series; apply distribution backports as they become available from Red Hat, SUSE, Ubuntu, and Debian security teams. The upstream commits are published at https://git.kernel.org/stable/c/1f16679a5aa60238466ce339c35f5e82ece60337 and the four sibling stable-tree backports (4a4a6e12, 979c708e, c2932e16, d41e37f2). As a compensating control on unpatched systems, restrict access to kernel tracing facilities (tracefs at /sys/kernel/tracing and debugfs) to root only and avoid enabling stack-trace events on the softirq tracepoint - note that this disables observability for performance/debugging workflows that legitimately rely on ftrace. Removing CAP_SYS_ADMIN from non-trusted users and disabling unsigned out-of-tree modules also reduces the practical trigger surface.

Affected VersionsENISA

Linux patch: 6.12.75
Linux 5.8
Linux patch: 6.18.14
Linux patch: 6.19.4
Linux 5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce <4a4a6e12c9c829be3f74b7206fa8640fc4e1c566
Linux patch: 6.6.128
Linux patch: 0
Linux 5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce <c2932e16d8c354404b17123e64daa8e33191e145
Linux 5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce <d41e37f26b3157b3f1d10223863519a943aa239b
Linux 5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce <979c708e6c9d7fc461daef2dad8b45f22e23464c
Linux patch: 7.0
Linux 5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce <1f16679a5aa60238466ce339c35f5e82ece60337

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

RCU (Read-Copy-Update) is a Linux kernel synchronization mechanism for lock-free read-side critical sections. Commit 5f5fa7ea89dc removed recursion-protection from __rcu_read_unlock(), and a prior fix (b41642c87716) addressed a related deadloop for the IRQ-work path but did not cover the softirq path. When ftrace is enabled and a softirq is raised from rcu_read_unlock_special(), the tracer's stack-walk re-enters rcu_read_unlock_special(), which raises the softirq again, producing unbounded recursion. The patch generalizes the existing protection flag (renamed defer_qs_pending) and sets it before calling raise_softirq_irqoff(). CWE-125 (out-of-bounds read) is the assigned class, though the observable behavior here is a recursion/stack-exhaustion deadloop rather than a classic OOB read.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 4.1 MEDIUM

Local trigger requiring CAP_SYS_ADMIN to enable ftrace (PR:H) and a specific RCU workload (AC:H); impact is kernel-hang DoS only, no confidentiality or integrity loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 16, 2026 - 02:37 NVD
7.1 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.1
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rcu: Fix rcu_read_unlock() deadloop due to softirq

Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") removes the recursion-protection code from __rcu_read_unlock(). Therefore, we could invoke the deadloop in raise_softirq_irqoff() with ftrace enabled as follows:

WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180 Modules linked in: my_irq_work(O) CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180 RSP: 0018:ffffc900000034a8 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329 RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000 R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054 FS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 __is_insn_slot_addr+0x54/0x70 kernel_text_address+0x48/0xc0 __kernel_text_address+0xd/0x40 unwind_get_return_address+0x1e/0x40 arch_stack_walk+0x9c/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 __raise_softirq_irqoff+0x61/0x80 __flush_smp_call_function_queue+0x115/0x420 __sysvec_call_function_single+0x17/0xb0 sysvec_call_function_single+0x8c/0xc0 </IRQ>

Commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") fixed the infinite loop in rcu_read_unlock_special() for IRQ work by setting a flag before calling irq_work_queue_on(). We fix this issue by setting the same flag before calling raise_softirq_irqoff() and rename the flag to defer_qs_pending for more common.

Executive ViewAI

Why It Matters

CVE-2026-45957 in the Linux kernel allows local attackers to crash or hang systems running with kernel tracing enabled through a denial-of-service vulnerability in the RCU subsystem. Although rated HIGH severity (CVSS 7.1), no public exploit has been identified and exploitation probability is minimal (EPSS 0.02%). Patch available per vendor advisory; deployment should be prioritized for systems with kernel monitoring or performance tracing active.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45957 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/366182 REF https://git.kernel.org/stable/c/1f16679a5aa60238466ce339c35f5e82ece60337 REF https://git.kernel.org/stable/c/4a4a6e12c9c829be3f74b7206fa8640fc4e1c566 REF https://git.kernel.org/stable/c/979c708e6c9d7fc461daef2dad8b45f22e23464c REF https://git.kernel.org/stable/c/c2932e16d8c354404b17123e64daa8e33191e145 REF https://git.kernel.org/stable/c/d36d8a7cf0e1d52ccde290855782b7b2ffc78f63 REF https://git.kernel.org/stable/c/d41e37f26b3157b3f1d10223863519a943aa239b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy