Skip to main content

Linux Kernel CVE-2026-53063

| EUVDEUVD-2026-38931 MEDIUM
2026-06-24 Linux GHSA-x22q-3h7c-4hgh
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only flaw requiring dm-cache passthrough configuration; low-privilege write access sufficient; no confidentiality or integrity impact possible.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 17:40 vuln.today
CVSS changed
Jul 21, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix write hang in passthrough mode

The invalidate_remove() function has incomplete logic for handling write hit bios after cache invalidation. It sets up the remapping for the overwrite_bio but then drops it immediately without submission, causing write operations to hang.

Fix by adding a new invalidate_committed() continuation that submits the remapped writes to the cache origin after metadata commit completes, while using the overwrite_endio hook to ensure proper completion sequencing. This maintains existing coherency. Also improve error handling in invalidate_complete() to preserve the original error status instead of using bio_io_error() unconditionally.

AnalysisAI

Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in invalidate_remove(), which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.

Technical ContextAI

The Linux kernel's device mapper (dm) cache target provides a block-level caching layer and supports several operational modes including passthrough, write-through, and write-back. In passthrough mode, writes bypass the cache and go directly to the origin device. The vulnerable function invalidate_remove() handles write hit bios - block I/O requests that arrive during cache invalidation sequences. It correctly constructs a remapped overwrite_bio pointing to the origin device, but due to incomplete control flow, it drops the bio immediately without submitting it via dm_io() or equivalent, causing the bio to never complete and the issuing process to hang. The fix introduces a new invalidate_committed() continuation that submits the remapped write after metadata commit, and repairs invalidate_complete() to preserve the original error status rather than unconditionally calling bio_io_error(). The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches introduced at commit b29d4986d0da1a27cd35917cdb433672f5c95d7f. No CWE is assigned; the root cause class maps most closely to CWE-670 (Always-Incorrect Control Flow Implementation).

RemediationAI

Update the Linux kernel to a patched stable release: 6.1.175 or later on the 6.1 branch, 6.6.141 or later on 6.6, 6.12.91 or later on 6.12, 6.18.33 or later on 6.18, 7.0.10 or later on 7.0, or 7.1 or later. Ubuntu users should apply the kernel updates published under USN-8566-1, USN-8567-1, and USN-8568-1 (https://ubuntu.com/security/notices/USN-8566-1). Upstream patch commits are available at https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78 and the related stable-branch commits listed in the CVE references. If immediate kernel upgrade is not feasible and dm-cache is in use, reconfigure the dm-cache device to write-through or write-back mode rather than passthrough to avoid the vulnerable invalidate_remove() code path - note this changes caching behavior and may affect performance and cache consistency semantics. Systems not using dm-cache are unaffected and require no action.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53063 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy