Skip to main content

Linux Kernel CVE-2026-53162

| EUVDEUVD-2026-39253 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-9mhf-2p25-mwm3
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.6 LOW

Local-only (AV:L) non-deterministic NMI/entropy race gives AC:H; some local foothold assumed (PR:L); realistic impact is weakened randomness (C:L) and possible instability (A:L), not full triad.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:18 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

memcg: use round-robin victim selection in refill_stock

Harry Yoo reported that get_random_u32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context.

More specifically get_random_u32_below() is neither reentrant- nor NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the batched_entropy_u32 state. An NMI that lands on a CPU mid-update of the ChaCha batch state and recurses into the random subsystem would corrupt that state. The memcg_stock local_trylock prevents re-entry on the percpu stock itself, but cannot protect an unrelated subsystem's per-cpu lock.

Replace the random pick with a per-cpu round-robin counter stored in memcg_stock_pcp and serialized by the same local_trylock that already guards cached[] and nr_pages[]. No atomics, no random calls, no extra locks needed.

AnalysisAI

Local privilege/availability weakness in the Linux kernel memory cgroup (memcg) subsystem stems from refill_stock() calling get_random_u32_below() for victim selection, a routine that is neither reentrant- nor NMI-safe. Because memcg charge draining can occur in NMI context, an NMI landing mid-update of the per-CPU batched_entropy_u32 ChaCha state could corrupt the random subsystem's per-CPU local_lock state. The fix replaces the random pick with a per-CPU round-robin counter serialized by the existing local_trylock; EPSS is very low (0.17%, 7th percentile), this is not in CISA KEV, and no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the Linux kernel's memory controller (memcg/cgroup) per-CPU charge cache (memcg_stock_pcp), which batches page charge accounting to reduce atomic contention. The original code used get_random_u32_below() to randomly choose a 'victim' cached entry to refill/evict. That helper draws from a per-CPU batched_entropy_u32 ChaCha20 pool guarded by local_lock_irqsave(); it is not designed for re-entry or NMI context. memcg draining can be invoked from NMI, so an NMI interrupting an in-progress entropy batch update on the same CPU and recursing into the random subsystem can corrupt the ChaCha batch state - a classic concurrency/reentrancy fault (CWE-828/CWE-662 class, kernel-supplied CWE is N/A). The memcg_stock local_trylock only protects the stock's own cached[]/nr_pages[] arrays, not the unrelated random subsystem's per-CPU lock, which is why the fix removes the random call entirely.

RemediationAI

Vendor-released patch: update to Linux kernel 7.0.13, 6.18.36, or 7.1 (or later) via your distribution's kernel update channel, which carries the upstream commits that replace get_random_u32_below() with a per-CPU round-robin counter (stable trees: https://git.kernel.org/stable/c/89bd8215e25aa6999cc51696da418e0d422bc5e0 and the related commits). There is no practical runtime workaround for this internal kernel concurrency fix, since the affected path (memcg charge draining) is core accounting logic that cannot be disabled without breaking cgroup memory control; given the very low exploitation probability (EPSS 0.17%, not in KEV), the appropriate action is to schedule the kernel update through normal patch cycles rather than emergency change. After patching, a standard reboot (or live-patch where supported) is required for the new kernel to take effect - note the usual reboot service-interruption trade-off.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53162 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy