Skip to main content

Linux Kernel CVE-2026-53312

| EUVDEUVD-2026-39847 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-26 Linux GHSA-h2cq-p42h-rq44
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger on RISC-V IOMMU hardware requiring low privileges; no confidentiality or integrity impact, high availability loss from kernel hang.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:36 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

iommu/riscv: Remove overflows on the invalidation path

Since RISC-V supports a sign extended page table it should support a gather->end of ULONG_MAX, but if this happens it will infinite loop because of the overflow.

Also avoid overflow computing the length by moving the +1 to the other side of the <

AnalysisAI

Integer overflow on the RISC-V IOMMU invalidation path in the Linux kernel triggers an infinite loop, causing a local denial of service. A low-privileged local user on an affected RISC-V system with IOMMU hardware can hang the kernel by inducing an invalidation where gather->end equals ULONG_MAX, exploiting the sign-extended page table range supported by RISC-V. EPSS is 0.15% (5th percentile), no active exploitation has been identified, and no public exploit code is known.

Technical ContextAI

The vulnerability resides in the iommu/riscv driver of the Linux kernel (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). RISC-V architecture supports sign-extended page tables, meaning the upper bound of a TLB invalidation gather range (gather->end) can legitimately hold the value ULONG_MAX. The invalidation loop computes a length by adding 1 to this value, producing an unsigned integer wraparound to zero, creating a loop condition that is never satisfied - a textbook CWE-835 (Loop with Unreachable Exit Condition). A secondary overflow in the length computation itself is also addressed by relocating the +1 arithmetic to the opposing side of the comparison operator. The fix is present in upstream commits 9f0632b0d4246675fa221aa1a3bffadf9c6bd9ac, e4b7687784153481de45fd39fb97ba3919605c0c, and 40a13b49957937427bc23e78eb50679df4396a47.

RemediationAI

Update to Linux kernel 7.0.10, 6.18.33, or 7.1 or later, which incorporate upstream commits 9f0632b0d4246675fa221aa1a3bffadf9c6bd9ac, e4b7687784153481de45fd39fb97ba3919605c0c, and 40a13b49957937427bc23e78eb50679df4396a47 via https://git.kernel.org/stable/c/. As a compensating control where patching is not immediately possible, disabling the RISC-V IOMMU driver at kernel build time (CONFIG_RISCV_IOMMU=n) or via kernel command-line parameters removes the vulnerable code path entirely, at the trade-off of losing IOMMU-based DMA isolation and memory protection for RISC-V peripherals. Restricting local user access on RISC-V IOMMU-equipped systems to trusted accounts limits exploitation opportunity but does not eliminate it.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy