Skip to main content

Linux Kernel CVE-2026-53185

| EUVDEUVD-2026-39276 HIGH
Signal Handler Race Condition (CWE-364)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4pqw-3h25-qrq3
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to zram-backed device
  2. Delivery
    Identify slots evicted to writeback backing device
  3. Exploit
    Issue partial sub-page write triggering async read
  4. Execution
    Buffer freed while read in flight
  5. Persist
    Async read corrupts freed page
  6. Impact
    Escalate privileges or disclose kernel memory

Vulnerability Assessment

Weakness
CWE
CWE-364
Exploitation Conditions

Exploitation requires the zram device to be configured with a writeback backing device (ZRAM_WB) - set via /sys/block/zramX/backing_dev - which is not the default zram configuration. The attacker must be a local user able to issue partial (sub-page) writes to a zram slot that has been written back to the backing device, triggering the asynchronous read path in zram_read_page() via zram_bvec_write_partial(). Limiting factors: access is local only (AV:L), some privilege/access to the zram-backed device or filesystem is needed (PR:L), no user interaction is required, and the bug does not manifest at all on the far more common zram-without-writeback deployments, substantially narrowing realistic exposure below the raw 7.8 score.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes a local, low-privilege flaw with full CIA impact consistent with a kernel UAF that can lead to memory disclosure or privilege escalation (the source tag 'Information Disclosure' aligns with leaking freed-page contents). Real-world risk is tempered by strong limiting signals: EPSS is only 0.18% (7th percentile), there is no KEV listing and no public exploit identified, and exploitation requires the non-default condition that a zram device be configured with a writeback backing device. There is friction between the published AC:L and the genuine precondition that an administrator has enabled zram writeback - the trigger is deterministic for ZRAM_WB slots, but the vulnerable configuration is not the common default, so realistic exposure is narrower than the 7.8 implies. No CVSS 4.0 or SSVC data was provided in the input, so automatable/technical-impact framing is inferred from the description rather than confirmed. Overall this is a legitimate kernel hardening fix to roll into normal stable-update cycles rather than an emergency.
Exploit ScenarioDerived

On a system where an administrator has configured zram with a writeback backing device, a local user with write access to the zram-backed block device or filesystem issues sub-page (partial) writes that target slots already evicted to the backing device. The kernel dispatches the backing read asynchronously and frees the page buffer before the read completes, so the in-flight read writes into freed memory, giving the attacker a use-after-free primitive usable for information disclosure or privilege escalation. No public proof-of-concept has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use-after-free in the Linux kernel zram block-device driver allows local attackers to corrupt freed kernel page memory when a zram device is configured with a writeback (ZRAM_WB) backing device. The flaw is in zram_bvec_write_partial(), which passes its parent bio into zram_read_page(), causing the backing-device read to be dispatched asynchronously and return before completion; the buffer is then copied, rewritten, and freed while the in-flight read still writes into it. With a CVSS of 7.8 (high) but a low EPSS of 0.18% (7th percentile) and no public exploit identified at time of analysis, this is a memory-corruption primitive with potential for privilege escalation but no evidence of real-world abuse.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release - 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, whichever matches your branch (commits at https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a and the related stable hashes). Until the kernel can be updated, the most effective compensating control is to avoid the vulnerable code path by not using zram with a writeback backing device: do not set /sys/block/zramX/backing_dev (or remove existing writeback configuration), which fully eliminates the ZRAM_WB partial-write path at the cost of losing cold-page eviction to disk and increasing RAM pressure under memory load. Where zram writeback must remain enabled, restrict who can issue I/O to the zram-backed device or filesystem (tighten mount permissions and avoid exposing zram block devices to untrusted local users), accepting the operational limits that imposes. Track fixes via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-53185.

Affected VersionsENISA

Linux 4.14
Linux 8e654f8fbff52ac483fb69957222853d7e2fc588 <0c2821665ff71be3f4b07ecece384669f2877f6a
Linux patch: 0
Linux 8e654f8fbff52ac483fb69957222853d7e2fc588 <732fd9f0b9c1cdc6dfd77162ded60df005182cc0
Linux patch: 6.18.36
Linux 8e654f8fbff52ac483fb69957222853d7e2fc588 <198b5a14cca27263b9c14b20114c8092de15dfcb
Linux patch: 7.1
Linux 8e654f8fbff52ac483fb69957222853d7e2fc588 <c96786d6ff1acc1d54d9241e97767554c1dfdd5b
Linux 8e654f8fbff52ac483fb69957222853d7e2fc588 <77a602b505ce4802915853cfc435a4722fab3e64
Linux patch: 6.12.94
Linux patch: 6.6.143
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

zram is the Linux kernel's compressed RAM block device, widely used for compressed swap and small ramdisks, and optionally backed by a real 'writeback' device (ZRAM_WB) to which cold/incompressible pages are evicted. The bug is a classic CWE-416 Use-After-Free (CWE listed as N/A in source feeds, but the description explicitly states 'use-after-free'). zram_read_page() chooses a synchronous or asynchronous backing-device read path depending on whether a parent bio is non-NULL; for ZRAM_WB slots the partial-write path supplied its parent bio, so the read ran asynchronously and zram_read_page() returned 0 while the bio was still in flight. The caller then executed memcpy_from_bvec(), zram_write_page() and __free_page() on the same buffer, so the still-running async read writes into a freed page. The fix mirrors commit 4e3c87b9421d ('zram: fix synchronous reads'), which already forced the read-partial counterpart to NULL; the write-partial path was simply missed.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local low-priv access to the zram device (AV:L/PR:L); AC:H because it requires the non-default admin-configured writeback backing device; kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

zram: fix use-after-free in zram_bvec_write_partial()

zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page.

zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

Executive ViewAI

Why It Matters

CVE-2026-53185, a high-severity use-after-free vulnerability in the Linux kernel zram driver with writeback enabled, allows any local user to corrupt kernel memory and escalate privileges. No public exploit code has been identified at time of analysis, but affected systems with local users face unmitigated privilege escalation risk. Organizations operating Linux systems with zram writeback enabled must deploy kernel patches immediately to prevent unauthorized administrative access.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching cannot be completed within 30 days, disable zram writeback on all affected systems (echo 0 > /sys/block/zram0/backing_dev) and restrict local shell access through privilege access management until patched kernels are deployed.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
zram ships in nearly all Linux kernels; writeback backing config is less common
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-364 – Signal Handler Race Condition

View all
CVE-2024-6387 HIGH POC
8.1
CVE-2024-6409 HIGH
7.0
CVE-2025-4598 MEDIUM POC
4.7
CVE-2026-24792 HIGH
8.1
CVE-2026-52910 HIGH
7.8
CVE-2026-42002 HIGH
7.5
CVE-2023-5676 MEDIUM
5.9
CVE-2023-1285 MEDIUM
5.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53185 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373719 REF https://access.redhat.com/errata/RHSA-2026:59723 REF https://access.redhat.com/errata/RHSA-2026:61887 REF https://access.redhat.com/errata/RHSA-2026:63013 REF https://access.redhat.com/errata/RHSA-2026:63014 REF https://access.redhat.com/errata/RHSA-2026:65708 REF https://access.redhat.com/security/cve/CVE-2026-53185 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492735 REF https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a REF https://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcb REF https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0 REF https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64 REF https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53185.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy