Skip to main content

Linux Kernel CVE-2026-53326

| EUVDEUVD-2026-40960 MEDIUM
Improper Locking (CWE-667)
2026-07-01 Linux GHSA-r6vx-43g9-hvqx
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the multiple required conditions (debug build, PREEMPT_RT, ARM64, early boot window); C:N and I:N confirmed by description and CVSS.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:13 vuln.today
CVSS changed
Jul 23, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

debugobjects: Don't call fill_pool() in early boot hardirq context

When booting a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage" lockdep warning message was reported to the console.

During early boot, interrupts are enabled before the scheduler is enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard interrupt context handler attempt to fill the pool

This can lead to a deadlock when the interrupt occurred when the interrupt hits a region which holds a lock that is required to be taken in the allocation path.

Add a new can_fill_pool() helper and reorder the exception rule and forbid this scenario by excluding allocations from hard interrupt context.

AnalysisAI

Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

The root cause is CWE-667 (Improper Locking) in the kernel's debugobjects memory pool management. The debugobjects subsystem (enabled via CONFIG_DEBUG_OBJECTS) tracks kernel object lifetimes and maintains a pool of debug objects via fill_pool(). On systems running a PREEMPT_RT (real-time preemption) kernel with lockdep enabled, the early boot sequence on ARM64 exposes a race window: interrupts are enabled before the scheduler is fully initialized (SYSTEM_SCHEDULING not yet set). In this window, a hardware interrupt handler can invoke fill_pool(), which takes allocation-path locks. If the interrupted boot-time code already holds one of those locks, the result is a classic HARDIRQ-ON-W / IN-HARDIRQ-W lockdep warning and a potential deadlock. CPE data (cpe:2.3:a:linux:linux) confirms the affected product is the mainline Linux kernel. The fix introduces a can_fill_pool() guard that forbids fill_pool() calls from hard interrupt context during this early boot phase.

RemediationAI

Upgrade to Linux kernel 7.1 or Linux 7.0.13 (stable), which include the can_fill_pool() guard fix. The upstream fix commits are available at https://git.kernel.org/stable/c/44b8b03a9fb5c575548fc72c674653d6baba142a, https://git.kernel.org/stable/c/7bc71bdb1c1526c7f02a6adab324394ff1327b0a, and https://git.kernel.org/stable/c/0d046ae106255cba5eb83b23f78ee93f3620247d, along with additional stable-branch fixes at https://git.kernel.org/stable/c/27335c50014102e9077b784ebd314954286afcab, https://git.kernel.org/stable/c/3cc90ea0dd0fb1f8db577dcdc027fc46c06049f6, and https://git.kernel.org/stable/c/5d95f6b267f3d7fe54f42a3b224bb4a3d3990b41. For systems that cannot be immediately updated, the most effective workaround is to disable CONFIG_DEBUG_OBJECTS at compile time - this eliminates the entire code path; note this also removes object lifetime debugging. Alternatively, disabling PREEMPT_RT (switching to PREEMPT_VOLUNTARY or fully preemptible without the RT patchset) removes the condition. Neither workaround is appropriate for production RT systems requiring real-time guarantees; patching to 7.0.13 or 7.1 is strongly preferred.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53326 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy