Skip to main content

Linux Kernel CVE-2026-53185

| EUVDEUVD-2026-39276 HIGH
Signal Handler Race Condition (CWE-364)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4pqw-3h25-qrq3
Linux Information Disclosure
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv access to the zram device (AV:L/PR:L); AC:H because it requires the non-default admin-configured writeback backing device; kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:25 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

zram: fix use-after-free in zram_bvec_write_partial()

zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page.

zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

AnalysisAI

Use-after-free in the Linux kernel zram block-device driver allows local attackers to corrupt freed kernel page memory when a zram device is configured with a writeback (ZRAM_WB) backing device. The flaw is in zram_bvec_write_partial(), which passes its parent bio into zram_read_page(), causing the backing-device read to be dispatched asynchronously and return before completion; the buffer is then copied, rewritten, and freed while the in-flight read still writes into it. With a CVSS of 7.8 (high) but a low EPSS of 0.18% (7th percentile) and no public exploit identified at time of analysis, this is a memory-corruption primitive with potential for privilege escalation but no evidence of real-world abuse.

Technical ContextAI

zram is the Linux kernel's compressed RAM block device, widely used for compressed swap and small ramdisks, and optionally backed by a real 'writeback' device (ZRAM_WB) to which cold/incompressible pages are evicted. The bug is a classic CWE-416 Use-After-Free (CWE listed as N/A in source feeds, but the description explicitly states 'use-after-free'). zram_read_page() chooses a synchronous or asynchronous backing-device read path depending on whether a parent bio is non-NULL; for ZRAM_WB slots the partial-write path supplied its parent bio, so the read ran asynchronously and zram_read_page() returned 0 while the bio was still in flight. The caller then executed memcpy_from_bvec(), zram_write_page() and __free_page() on the same buffer, so the still-running async read writes into a freed page. The fix mirrors commit 4e3c87b9421d ('zram: fix synchronous reads'), which already forced the read-partial counterpart to NULL; the write-partial path was simply missed.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release - 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, whichever matches your branch (commits at https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a and the related stable hashes). Until the kernel can be updated, the most effective compensating control is to avoid the vulnerable code path by not using zram with a writeback backing device: do not set /sys/block/zramX/backing_dev (or remove existing writeback configuration), which fully eliminates the ZRAM_WB partial-write path at the cost of losing cold-page eviction to disk and increasing RAM pressure under memory load. Where zram writeback must remain enabled, restrict who can issue I/O to the zram-backed device or filesystem (tighten mount permissions and avoid exposing zram block devices to untrusted local users), accepting the operational limits that imposes. Track fixes via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-53185.

Same weakness CWE-364 – Signal Handler Race Condition

View all
CVE-2024-6387 HIGH POC
8.1
CVE-2024-6409 HIGH
7.0
CVE-2025-4598 MEDIUM POC
4.7
CVE-2026-24792 HIGH
8.1
CVE-2026-52910 HIGH
7.8
CVE-2026-42002 HIGH
7.5
CVE-2023-5676 MEDIUM
5.9
CVE-2023-1285 MEDIUM
5.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53185 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy