Skip to main content

Linux Kernel CVE-2026-53020

| EUVDEUVD-2026-38888 HIGH
Race Condition (CWE-362)
2026-06-24 Linux GHSA-m33q-f5vx-jwmj
Linux Information Disclosure Race Condition Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access and low privilege are required (AV:L/PR:L); as a timing race condition AC:H is more honest than the vendor's AC:L, while page-table corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:51 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

um: Fix potential race condition in TLB sync

During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.

AnalysisAI

Local privilege escalation or memory disclosure is possible in the User Mode Linux (UML/'um') architecture of the Linux kernel (affected around 6.19, fixed in 7.0.10 and 7.1) due to a TLB-sync race condition where the page table is traversed and modified without holding the page table lock. Concurrent threads in the same process can corrupt page table state, with CVSS 7.8 (local, low-privilege) and a high-impact triad; there is no public exploit identified at time of analysis and EPSS is low at 0.15% (5th percentile), consistent with a hard-to-trigger local race rather than a mass-exploited flaw.

Technical ContextAI

User Mode Linux (UML) is a port of the Linux kernel that runs as an ordinary userspace process, emulating its own memory management via host-managed page tables. The flaw lives in UML's TLB synchronization path, which walks and mutates the guest page table; because full SMP support for threads within the same UML process is incomplete, the code failed to serialize these page-table operations under the page table lock. This is a classic concurrency defect (CWE-362, race condition / improper synchronization on shared kernel data structures) - the fix disables the split page table lock for UML to force serialization. The CPE data only generically identifies cpe:2.3:a:linux:linux, so the vulnerable surface is specifically the UML subsystem rather than a mainstream x86/ARM kernel configuration.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed Linux kernel build - stable patch level 7.0.10 or the 7.1 series - which incorporate stable commits f21c343ec7419377bff89ab11146c03ae117036f and 102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3 that disable the split page table lock to serialize TLB-sync page-table access; obtain these from https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53020. If you cannot rebuild immediately, the most effective compensating control is to avoid running workloads under User Mode Linux on unpatched kernels, since the defect only manifests in the UML architecture - migrate affected sandboxing/CI workloads to a patched host kernel or to standard virtualization (KVM), accepting the trade-off of changed isolation tooling. Where UML must remain, restrict local access to trusted users only, as exploitation requires the ability to run code locally inside the UML instance.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53020 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy