Skip to main content

Linux Kernel CVE-2026-53265

| EUVDEUVD-2026-39216 HIGH
Race Condition (CWE-362)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-257g-7vrp-j9f8
Information Disclosure Linux Race Condition
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privileged access
  2. Delivery
    Reach dm-cache smq invalidation path
  3. Exploit
    Race two concurrent invalidators on one entry
  4. Execution
    Double-free entry, corrupt SMQ queues/hash
  5. Impact
    Kernel panic or escalation

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the system to be running the device-mapper dm-cache target configured with the smq cache replacement policy, and the attacker must be a local low-privileged user (CVSS PR:L) able to initiate concurrent cache-block invalidation operations on that cache. It is not remotely exploitable (AV:L) and needs no user interaction (UI:N). The principal limiting factors are: the smq policy must be in active use (a non-default configuration on most systems, since dm-cache is an optional storage feature), the attacker must reach the invalidation path, and success depends on winning a narrow check-then-act race window between two concurrent invalidators - making reliable exploitation timing-sensitive rather than deterministic.
Impact

Signals are mostly consistent in pointing to a real but not urgent issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) reflects local, low-privilege access with high impact typical of kernel memory corruption. However, AC:L likely understates difficulty: exploiting a check-then-act race reliably requires winning a narrow timing window with concurrent invalidators, which in practice is closer to high attack complexity. EPSS is low (0.17%, 7th percentile), there is no KEV listing and no public exploit identified, so this is not under active or widespread exploitation. The input 'Information Disclosure' tag conflicts with the actual impact, which is queue/hash corruption and double-free (denial of service, with theoretical escalation), not primarily disclosure - treat that tag as unreliable. A key limiting factor not captured by the raw score is that exploitation requires the dm-cache target to be configured with the smq policy and the attacker to be able to drive cache-block invalidations, which materially narrows the real-world attack surface versus a generic local kernel bug.
Exploit ScenarioDerived

On a host using dm-cache with the smq policy, a low-privileged local user with the ability to trigger cache-block invalidations races two concurrent invalidation operations against the same entry. Both observe the entry as allocated before either takes mq->lock, leading to a double free_entry() and corruption of the SMQ queues/hash table - crashing the kernel or potentially enabling further escalation. No public proof-of-concept is identified at time of analysis, and reliable exploitation requires winning a tight timing window.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege-escalation/memory-corruption in the Linux kernel device-mapper dm-cache 'smq' policy allows a low-privileged local user to trigger a check-then-act race in smq_invalidate_mapping(). The e->allocated predicate was evaluated outside mq->lock, so two concurrent cache-block invalidators can both see an entry as allocated and free it twice, corrupting the SMQ queues/hash table and tripping the allocation assertion in free_entry(). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile); the issue is not listed in CISA KEV.

RemediationAI

Apply the vendor-released stable kernel update for your tree: upgrade to 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13 (or later) as appropriate, which moves the e->allocated allocation check under mq->lock so the predicate and destructive operations are serialized. The fix is available as tagged stable releases and as upstream commits at https://git.kernel.org/stable/c/d3f0a606b9f278ece8a0df626ded9c4044071235 and the related stable commits referenced in NVD; distribution users should pull the corresponding distro kernel errata. If immediate patching is not possible, the most direct compensating control is to avoid the vulnerable code path by not deploying dm-cache with the smq policy (e.g., reconfigure caches to a non-affected policy or remove dm-cache acceleration), accepting the trade-off of reduced or eliminated cache tiering performance; additionally restrict which local accounts can administer or trigger device-mapper/dm-cache operations, accepting reduced operational flexibility for storage management. Reboot is required for the new kernel to take effect.

Affected VersionsENISA

Linux 2b62d0611c9af14a16bddf22df2612b4f40eb5a1 <c57570fba24016ec25ec046ab44db39143fb7a64
Linux c348ae47d8e65f06429fa41adce9ad986b696766 <42ff6774ecd9d7f70d599cb71ff64373a1da4948
Linux 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e <d886945fcb0f8c9dc6b39928d7a96c95c587346c
Linux 5.15.209 <5.15.210
Linux 6.6.141 <6.6.143
Linux ac5ee99443891bdb161f5539606a66a1b5e72542 <b4892561552d671bd8c4da5ebb70e9fbb1ec446e
Linux 4991b5a08751e2e82488fb93ae08849b6aea10d9 <c242c7af2aecf0b538b8623bdb86b8b441da38d9
Linux 6.1.175 <6.1.176
Linux 6.18.33 <6.18.36
Linux 2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45 <d3f0a606b9f278ece8a0df626ded9c4044071235
Linux 6.12.91 <6.12.94
Linux 5.10.258 <5.10.259
Linux 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513 <13da856c86fb8c2ccab95034fd77da1bb2c2a17c
Linux 93627a29d4b66d4a2def938dfb8610cc80ae454b <03ffe1112ed88bb3a9bd0b971549bf4d64bfc59a
Linux 7.0.10 <7.0.13

Affected Packages

euvd linux fix: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the Linux kernel's device-mapper (dm) caching subsystem, specifically the Stochastic Multiqueue (smq) cache replacement policy used by the dm-cache target to manage which blocks live on the fast cache device versus the slow origin device. smq tracks cache blocks via per-entry state (struct entry, including e->allocated), multiple priority queues, and a hash table, all protected by mq->lock. The root cause is a concurrency defect (CWE-362 race condition leading to CWE-415 double-free / CWE-416 use-after-free): commit 2d1f7b65f5de added locking around the destructive portion of smq_invalidate_mapping() but left the e->allocated read outside the critical section, breaking serialization between the predicate and the queue/hash mutation plus free_entry() call. Because the description identifies no CVE-assigned CWE, the weakness class is inferred from the code behavior, not from a vendor CWE mapping.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.3 MEDIUM

Local low-priv access (AV:L/PR:L); race timing makes AC:H; impact is memory corruption causing integrity/availability loss (I:H/A:H) with no real disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm cache policy smq: check allocation under invalidate lock

commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section.

That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check.

This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again.

Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock.

Executive ViewAI

Why It Matters

Linux kernel vulnerability in device-mapper dm-cache (CVE-2026-53265) allows local users to gain elevated system privileges through a memory-corruption race condition, potentially compromising systems in multi-user or shared infrastructure environments. Affected organizations should prioritize patching, particularly development, testing, and container-hosting infrastructure where privilege escalation could lead to lateral movement or workload compromise. Exploitation requires local system access, limiting external attack surface but affecting internal threat vectors.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere, though dm-cache smq policy is rarely enabled
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53265 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373812 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/03ffe1112ed88bb3a9bd0b971549bf4d64bfc59a REF https://git.kernel.org/stable/c/13da856c86fb8c2ccab95034fd77da1bb2c2a17c REF https://git.kernel.org/stable/c/42ff6774ecd9d7f70d599cb71ff64373a1da4948 REF https://git.kernel.org/stable/c/b4892561552d671bd8c4da5ebb70e9fbb1ec446e REF https://git.kernel.org/stable/c/c242c7af2aecf0b538b8623bdb86b8b441da38d9 REF https://git.kernel.org/stable/c/c57570fba24016ec25ec046ab44db39143fb7a64 REF https://git.kernel.org/stable/c/d3f0a606b9f278ece8a0df626ded9c4044071235 REF https://git.kernel.org/stable/c/d886945fcb0f8c9dc6b39928d7a96c95c587346c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy