Skip to main content

Linux Kernel CVE-2026-53333

| EUVDEUVD-2026-40967 MEDIUM
2026-07-01 Linux GHSA-hmwj-3ghp-wjg8
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Non-default kernel build configuration (CONFIG_SWAP=n with CONFIG_MIGRATION/MEMORY_FAILURE=y) is beyond attacker control, justifying AC:H over vendor-assigned AC:L; no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:48 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/mincore: handle non-swap entries before !CONFIG_SWAP guard

mincore_swap() also fields migration/hwpoison entries (and shmem swapin-error entries), which can exist on !CONFIG_SWAP builds when CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled. The !IS_ENABLED(CONFIG_SWAP) guard ran before the non-swap-entry early return, so mincore_pte_range() can spuriously WARN and report these pages nonresident on !CONFIG_SWAP kernels.

Move the guard below the non-swap-entry check so only true swap entries trip the WARN, and migration/hwpoison entries take the existing "uptodate / non-shmem" path.

AnalysisAI

Incorrect guard ordering in the Linux kernel's mincore subsystem causes spurious kernel WARN events and false non-resident page reporting on kernels compiled without CONFIG_SWAP support. Affected are Linux 6.18.x (before 6.18.36) and 7.x (before 7.0.13/7.1) builds where CONFIG_SWAP is disabled but CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled - a configuration typical of embedded or specialized deployments. With EPSS at 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to niche build environments.

Technical ContextAI

The vulnerability resides in mm/mincore.c, within the mincore_swap() and mincore_pte_range() functions that implement the mincore(2) syscall, which reports whether virtual memory pages are resident. When the kernel encounters page table entries representing migration events (CONFIG_MIGRATION) or hardware memory poisoning (CONFIG_MEMORY_FAILURE), these are 'non-swap entries' that should be handled via an early return path. However, the !IS_ENABLED(CONFIG_SWAP) guard was positioned before this non-swap-entry check, so on !CONFIG_SWAP kernels, migration and hwpoison PTEs - which legitimately exist when CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is compiled in - incorrectly trigger a WARN_ON and are misreported as non-resident. The root cause is a logic ordering error (analogous to CWE-670, Always-Incorrect Control Flow Implementation), not a memory corruption or privilege flaw. The CPE identifier is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The fix moves the CONFIG_SWAP guard below the non-swap-entry check so only true swap entries trip the WARN.

RemediationAI

Upstream fix commits are available in the Linux kernel stable tree: a8f91ddf67f669f547bb9fb559738da6f8ee2cf3 at https://git.kernel.org/stable/c/a8f91ddf67f669f547bb9fb559738da6f8ee2cf3, 0c25b8734367574e21aeb8468c2e522713134da7 at https://git.kernel.org/stable/c/0c25b8734367574e21aeb8468c2e522713134da7, and 3481d4372ae34243f7025925314385b852c50f7e at https://git.kernel.org/stable/c/3481d4372ae34243f7025925314385b852c50f7e. Administrators should upgrade to Linux 6.18.36, 7.0.13, or 7.1 per their tracked stable branch. For systems that cannot be immediately patched, two compensating controls apply: (1) setting panic_on_warn=0 via sysctl or kernel command line eliminates the kernel-panic risk from the spurious WARN, though it does not fix the incorrect mincore(2) reporting - this is broadly safe but masks other legitimate kernel warnings; (2) rebuilding the kernel with CONFIG_MIGRATION=n and CONFIG_MEMORY_FAILURE=n eliminates the affected PTE types entirely, but disables memory hotplug migration and hardware memory error recovery, which may be unacceptable on systems with ECC RAM or NUMA topologies.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53333 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy