Skip to main content

Linux Kernel CVE-2026-53108

| EUVDEUVD-2026-38976 MEDIUM
Race Condition (CWE-362)
2026-06-24 Linux GHSA-2377-3vvp-rhhq
Information Disclosure Linux IBM Race Condition Debian
4.7
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local user access on ppc64le Linux host
  2. Delivery
    Allocate THP-backed virtual memory region
  3. Exploit
    Launch Thread A: call move_pages() to trigger PMD migration entry state
  4. Install
    Race window: PMD held in non-present migration-swap state
  5. C2
    Thread B: concurrent munmap() acquires page table lock
  6. Execute
    VM_BUG_ON(!pmd_present) fires in pmdp_huge_get_and_clear_full()
  7. Impact
    Kernel panic, system crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) A PowerPC 64-bit (ppc64le) host running Linux kernel 5.8 through the pre-fix versions - x86 and ARM are not affected. (2) A memory region backed by standard Transparent Huge Pages or zone-device/device-private THP; systems with THP set to 'never' eliminate this code path. (3) Local user access (PR:L) with permission to call move_pages() - typically available to any process owning its own mappings, not requiring root. (4) The ability to race a concurrent munmap() against the move_pages() migration window, which is inherently narrow and timing-dependent (AC:H). Exploitation is limited by: the narrow race window between pmdp_invalidate() and page copy completion; requirement for ppc64le architecture; and THP being enabled. Systems not running workloads that exercise NUMA page migration (move_pages()) alongside concurrent memory unmapping have effectively no exposure even when unpatched.
Impact

The NVD-assigned CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 4.7) accurately reflects the threat model: this is a local, high-complexity race with no confidentiality or integrity impact. AC:H is appropriate given the narrow race window that must be hit between pmdp_invalidate() and the page copy phase. EPSS at 0.15% (5th percentile) confirms extremely low exploitation probability with no evidence of exploitation attempts. There is no CISA KEV listing. Critically, the vulnerability is architecture-specific to PowerPC 64-bit (Book3S64), which dramatically limits the affected population to IBM POWER-based servers, ppc64le container hosts, and similar deployments. For most organizations running x86 or ARM infrastructure, this CVE is not applicable. For IBM POWER environments running multi-tenant workloads with THP enabled, the risk is a local denial-of-service (kernel panic), not data exposure or privilege escalation. This is a kernel correctness fix with low operational urgency outside of PowerPC-specific deployments.
Exploit ScenarioDerived

A local low-privileged user on a ppc64le IBM POWER server spawns two concurrent threads against a shared THP-backed mapping: Thread A calls move_pages() to trigger PMD migration, while Thread B simultaneously calls munmap() on the same region. If Thread B's munmap() acquires the page table lock during the narrow window after pmdp_invalidate() but before the page copy completes, it encounters a non-present PMD entry and triggers the VM_BUG_ON() assertion, producing a kernel panic and crashing the system. No public exploit code is known, and the AC:H CVSS rating reflects the genuine difficulty of reliably hitting this race window.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.

RemediationAI

The primary fix is to upgrade to Linux kernel stable version 7.0.10 or 7.1, which incorporate the upstream patches at https://git.kernel.org/stable/c/829367e55012c053738ebe7db20c4a90d6609ece and https://git.kernel.org/stable/c/bbcbf045d6c778e82b47a35fc8728387708e9a3d. Ubuntu ppc64le administrators should apply kernel updates per USN-8568-1 and USN-8566-1 (https://ubuntu.com/security/notices/USN-8568-1). Debian ppc64le users should track their stable/security kernel updates referencing the same fix commits. Where immediate patching is not possible, compensating controls include: restricting access to the move_pages() syscall via seccomp filtering on sensitive workloads (trade-off: breaks legitimate NUMA memory migration in HPC and database applications); disabling Transparent Huge Pages at the OS level ('echo never > /sys/kernel/mm/transparent_hugepage/enabled') to eliminate the PMD migration path entirely (trade-off: may degrade memory performance on large-footprint workloads); or limiting local untrusted user access on ppc64le kernel hosts. None of these workarounds are necessary on x86 or ARM systems.

Affected VersionsENISA

Linux patch: 0
Linux 5.8
Linux 75358ea359e7c0dfceb3c7b3d854570b4260cb7f <829367e55012c053738ebe7db20c4a90d6609ece
Linux patch: 7.1
Linux patch: 7.0.10
Linux 75358ea359e7c0dfceb3c7b3d854570b4260cb7f <bbcbf045d6c778e82b47a35fc8728387708e9a3d

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is specific to the powerpc/64s Book3S64 memory management layer of the Linux kernel, within the PMD (Page Middle Directory) handling for Transparent Huge Pages. During page migration via the move_pages() syscall, set_pmd_migration_entry() transitions the PMD through an intermediate state: pmdp_invalidate() marks it as _PAGE_INVALID, then set_pmd_at() sets it to a migration swap entry where pmd_present() returns false but pmd_none() is also false. The race was further widened by upstream commit a30b48bf1b24 ('mm/migrate_device: implement THP migration of zone device pages'), which added device-private PMD entry migration support. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) is the root cause: the ptl (page table lock) released after set_pmd_migration_entry() and re-acquired by zap_huge_pmd() during munmap() is insufficient to prevent the interleaved state from reaching pmdp_huge_get_and_clear_full(), which asserts VM_BUG_ON(!pmd_present(*pmdp)) at arch/powerpc/mm/book3s64/pgtable.c:187. CPE cpe:2.3:a:linux:linux:* confirms the upstream Linux kernel as the affected product.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Local race on ppc64le only; PR:L since move_pages() is callable by non-root process owners; AC:H for narrow timing window; no C/I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 23, 2026 - 21:38 NVD
4.7 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: Fix unmap race with PMD migration entries

The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full().

This patch fixes that.

Thread A: move_pages() syscall add_folio_for_migration() mmap_read_lock(mm) folio_isolate_lru(folio) mmap_read_unlock(mm)

do_move_pages_to_node() migrate_pages() try_to_migrate_one() spin_lock(ptl) set_pmd_migration_entry() pmdp_invalidate()

PMD: _PAGE_INVALID | _PAGE_PTE | pfn

set_pmd_at()

PMD: migration swap entry (pmd_present=0)

spin_unlock(ptl) [page copy phase]

<--- RACE WINDOW -->

Thread B: munmap() mmap_write_downgrade(mm) unmap_vmas() -> zap_pmd_range() zap_huge_pmd() __pmd_trans_huge_lock() pmd_is_huge():

!pmd_present && !pmd_none -> TRUE (swap entry)

pmd_lock() ->

spin_lock(ptl), waits for Thread A to release ptl

pmdp_huge_get_and_clear_full() VM_BUG_ON(!pmd_present(*pmdp))

HITS!

[ 287.738700][ T1867] ------------[ cut here ]------------ [ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187! cpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0] pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c lr: c000000000645dec: zap_huge_pmd+0xb0/0x868 sp: c00000044037f790 msr: 800000000282b033 current = 0xc0000004032c1a00 paca = 0xc000000004fe0000 irqmask: 0x03 irq_happened: 0x09 pid = 1867, comm = a.out kernel BUG at :187! Linux version 6.19.0-12136-g14360d4f917c-dirty (powerpc64le-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #27 SMP PREEMPT Sun Feb 22 10:38:56 IST 2026 enter ? for help [link register ] c000000000645dec zap_huge_pmd+0xb0/0x868 [c00000044037f790] c00000044037f7d0 (unreliable) [c00000044037f7d0] c000000000645dcc zap_huge_pmd+0x90/0x868 [c00000044037f840] c0000000005724cc unmap_page_range+0x176c/0x1f40 [c00000044037fa00] c000000000572ea0 unmap_vmas+0xb0/0x1d8 [c00000044037fa90] c0000000005af254 unmap_region+0xb4/0x128 [c00000044037fb50] c0000000005af400 vms_complete_munmap_vmas+0x138/0x310 [c00000044037fbe0] c0000000005b0f1c do_vmi_align_munmap+0x1ec/0x238 [c00000044037fd30] c0000000005b3688 __vm_munmap+0x170/0x1f8 [c00000044037fdf0] c000000000587f74 sys_munmap+0x2c/0x40 [c00000044037fe10] c000000000032668 system_call_exception+0x128/0x350 [c00000044037fe50] c00000000000d05c system_call_vectored_common+0x15c/0x2ec ---- Exception: 3000 (System Call Vectored) at 0000000010064a2c SP (7fff9b1ee9c0) is in userspace 0:mon> zh

commit a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages"), enabled migration for device-private PMD entries. Hence this is one other path where this warning could get trigger from.

------------[ cut here ]------------ WARNING: arch/powerpc/mm/book3s64/hash_pgtable.c:199 at hash__pmd_hugepage_update+0x48/0x284, CPU#3: hmm-tests/1905 Modules linked in: test_hmm CPU: 3 UID: 0 PID: 1905 Comm: hmm-tests Tainted: G B W L N 7.0.0-rc1-01438-g7e2f0ee7581c #21 PREEMPT Tainted: [B]=BAD_PAGE, [W]=WARN, [L]=SOFTLOCKUP, [N]=TEST Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries NIP [c000000000096b70] hash__pmd_hugepage_update+0x48/0x284 LR [c000000000096e7c] hash__pmdp_huge_get_and_clear+0xd0/0xd4 Call Trace: [c000000604707670] [c000000004e102b8] 0xc000000004e102b8 (unreliable) [c000000604707700] [c00000000064ec3c] set_pmd_migration_entry+0x414/0x498 [c000000604707760] [c00000000063e5a4] migrate_vma_col ---truncated---

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Low
architecture-specific to PowerPC 64-bit, not x86/ARM
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

24
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53108 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373359 REF https://git.kernel.org/stable/c/09207dc57ab4cb8967e6cad55a37e15ff8523d41 REF https://git.kernel.org/stable/c/829367e55012c053738ebe7db20c4a90d6609ece REF https://git.kernel.org/stable/c/bbcbf045d6c778e82b47a35fc8728387708e9a3d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy