Skip to main content

Linux Kernel CVE-2026-53335

| EUVDEUVD-2026-40969 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-01 Linux GHSA-wxxm-77v6-p8hq
Denial Of Service RCE Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local sysfs write requires low privilege; NULL deref causes kernel crash only, so C:N/I:N; AC:L once local access exists despite needing memory pressure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:49 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/lru_sort: handle ctx allocation failure

DAMON_LRU_SORT allocates the damon_ctx object for its kdamond in its init function. damon_lru_sort_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL.

AnalysisAI

NULL pointer dereference in the Linux kernel's DAMON LRU Sort subsystem crashes the kernel when damon_ctx allocation fails under memory pressure. Affected are Linux kernel versions through 6.18 and 7.0.x before 7.0.13, where damon_lru_sort_enabled_store() omits a NULL check before passing the allocation result to damon_commit_ctx(). A local attacker with low privileges can trigger a kernel panic, causing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.17% (6th percentile), reflecting negligible observed exploitation activity.

Technical ContextAI

The affected code is in mm/damon/lru_sort - the DAMON (Data Access Monitor) LRU-sort module within the Linux kernel memory management subsystem. DAMON_LRU_SORT uses a damon_ctx object to drive a kdamond kernel thread for LRU-based page sorting. The root cause is CWE-476 (NULL Pointer Dereference): damon_lru_sort_enabled_store() calls the damon_ctx allocator but does not verify the return value before forwarding the pointer to damon_commit_ctx(). Under memory pressure causing an allocation failure, ctx is NULL and the dereference causes a kernel oops or panic. The CPE is cpe:2.3:a:linux:linux, and the vulnerability was introduced in the DAMON LRU Sort feature path, not the core DAMON framework. The 'RCE' tag present in source metadata appears to be a tagging artifact - the CVSS vector explicitly shows C:N/I:N, and the description is unambiguously a DoS-only NULL dereference.

RemediationAI

The primary fix is to upgrade to patched kernel versions: Linux 6.18.36, 7.0.13, or 7.1. Upstream fix commits are available at https://git.kernel.org/stable/c/ab04340b5ae5d52c1d46b750538febcde9d889e7 (6.18 branch), https://git.kernel.org/stable/c/daab1996431a71f43219dcac48ecc9ad2aad3f1c (7.0 branch), and https://git.kernel.org/stable/c/6d48f15659395bf1381114f01be91bc68e0be46a (7.1 branch). Distribution vendors (RHEL, Debian, Ubuntu, SUSE) should be monitored for backported stable patches. As a compensating control on systems where kernel upgrade is not immediately feasible, the DAMON_LRU_SORT feature can be disabled by ensuring the CONFIG_DAMON_LRU_SORT kernel option is not compiled in, or by restricting write access to the relevant sysfs path (typically under /sys/kernel/mm/damon/) to prevent unprivileged users from triggering the code path. Restricting sysfs access does not eliminate the bug but reduces the attack surface to root-only interaction.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53335 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy