Skip to main content

Linux Kernel CVE-2026-53334

| EUVDEUVD-2026-40968 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-01 Linux GHSA-q79f-r3xp-pp5m
RCE Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local sysfs write requires low privilege (PR:L, AV:L); no confidentiality or integrity impact; kernel panic yields high availability impact only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:48 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/reclaim: handle ctx allocation failure

Patch series "mm/damon/{reclaim,lru_sort}: handle ctx allocation failures".

DAMON_RECLAIM and DAMON_LRU_SORT could dereference NULL pointers if their damon_ctx object allocations fail. The bugs are expected to happen infrequently because the allocations are arguably too small to fail on common setups. But theoretically they are possible and the consequences are bad. Fix those.

The issues were discovered [1] by Sashiko.

This patch (of 2):

DAMON_RECLAIM allocates the damon_ctx object for its kdamond in its init function. damon_reclaim_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL.

AnalysisAI

NULL pointer dereference in the Linux kernel's DAMON_RECLAIM memory management subsystem crashes the kernel when a damon_ctx object allocation fails during initialization. Local users with low privileges can trigger this by enabling DAMON_RECLAIM via its sysfs interface while the system is under memory pressure, causing damon_commit_ctx() to dereference a NULL pointer and inducing a kernel panic. No active exploitation is identified; EPSS of 0.17% (6th percentile) and absence from CISA KEV confirm this remains a low-probability, theoretically triggerable denial-of-service condition.

Technical ContextAI

DAMON (Data Access MONitor) is a Linux kernel subsystem providing adaptive memory management via DAMON_RECLAIM and DAMON_LRU_SORT, both of which require a damon_ctx object allocated during their init routines. The damon_reclaim_enabled_store() sysfs handler allocates this context but lacks a NULL check on the return value before proceeding to damon_commit_ctx(). Under CWE-476 (NULL Pointer Dereference), if the kernel allocator returns NULL due to memory exhaustion, execution falls through to damon_commit_ctx(ctx) with ctx = NULL, triggering a kernel oops or panic. The bug was present since commit 3f7a914ab9a5e46cf8aac7de270f02aa3f63de04 and requires CONFIG_DAMON_RECLAIM to be compiled in. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 7.1, 7.0.13, or 6.18.36, which contain the fix commits backported to the stable tree and available at https://git.kernel.org/stable/. Distribution users should apply the relevant vendor-provided kernel update for their supported series (RHEL, Debian, Ubuntu, SUSE). As a compensating control where patching is not immediately possible, disabling or not loading DAMON_RECLAIM (by ensuring CONFIG_DAMON_RECLAIM is not compiled in, or by not enabling it via sysfs) prevents this code path from being reached entirely; the trade-off is loss of DAMON-driven proactive memory reclamation, which may affect memory efficiency on workloads relying on that feature. Restricting write access to the DAMON sysfs interface to privileged users only reduces the attack surface but does not eliminate the underlying bug.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53334 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy