Skip to main content

Linux Kernel CVE-2026-53277

| EUVDEUVD-2026-39228 HIGH
Missing Synchronization (CWE-820)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fgxj-vfg7-cpqq
Linux Code Injection
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local guest access (AV:L) with privilege to run a VM (PR:L); a memslot race raises complexity to AC:H; host impact across the VM boundary gives S:C with high CIA from potential UAF.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:52 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation

walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking kvm->srcu.

Fix by acquiring kvm->srcu prior to the table walk in both instances.

AnalysisAI

Local privilege escalation / host compromise risk in the Linux kernel arm64 KVM subsystem arises because __kvm_at_s12() (AT instruction emulation) and __kvm_find_s1_desc_level() invoke the stage-1/nested stage-2 page-table walkers walk_s1() and kvm_walk_nested_s2() without holding kvm->srcu, which those walkers require to guard against concurrent memslot changes. A malicious or compromised guest on an affected arm64 host can race memslot updates against these walks, with CVSS scoring confidentiality, integrity and availability all High under a changed scope (host impact). It is patched in stable trees, EPSS is low (0.17%), and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in KVM on arm64, the kernel's hardware virtualization layer. SRCU (Sleepable RCU) is the synchronization primitive KVM uses to publish memslot (guest-physical to host-virtual memory mapping) configurations; readers that walk guest page tables must hold kvm->srcu so a concurrent memslot update cannot free or remap structures mid-walk. Two callers - __kvm_at_s12(), which emulates the Address Translation (AT) instructions for stage-1 and stage-2 translation, and __kvm_find_s1_desc_level(), used in fault injection / descriptor lookup - entered walk_s1() and kvm_walk_nested_s2() (the nested-virtualization stage-2 walker) without acquiring that lock. The root cause is a missing-lock / race-condition class defect (no CWE was assigned in the feed; this is effectively CWE-667 Improper Locking / CWE-362 race condition), not the 'Code Injection' label applied by an automated tagger. The fix simply wraps both walks in kvm->srcu read-side critical sections.

RemediationAI

Apply the stable-kernel update that contains the SRCU fix: upgrade to a patched build such as 6.18.36, 7.0.13, or 7.1 for the corresponding series (Vendor-released patch confirmed; pull the exact stable tag matching your tree). The change is contained in commits https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc, https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39, and https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251, so distribution kernels can be matched against these. There is no in-kernel toggle that disables only the buggy code paths, but because exposure is limited to arm64 KVM hosts, compensating controls until patching include not running untrusted or multi-tenant guests on affected arm64 hypervisors and avoiding nested virtualization on those hosts (trade-off: nested KVM and some guest features become unavailable); on non-arm64 or non-KVM systems no action is required. Reference the EUVD/NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53277 for tracking.

Same weakness CWE-820 – Missing Synchronization

View all
CVE-2026-70637 HIGH POC
8.2
CVE-2025-47154 CRITICAL
9.0
CVE-2025-1445 HIGH
8.7
CVE-2026-53153 HIGH
7.8
CVE-2026-22163 HIGH
7.8
CVE-2024-49114 HIGH
7.8
CVE-2022-50238 HIGH
7.4
CVE-2024-30387 HIGH
7.1

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53277 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy