Skip to main content

Linux Kernel CVE-2026-53336

| EUVDEUVD-2026-40970 MEDIUM
2026-07-01 Linux GHSA-hm49-92mv-rrfr
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges required; hardware-specific trigger limits scope; availability-only impact (kernel hang); no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:49 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvmem: layouts: onie-tlv: fix hang on unknown types

The EEPROM on my board has a vendor specific entry of type 0x41. When stumbling upon that, this driver hangs in an endless loop.

Fix it by keep incrementing the offset on unknown entries, so the loop will eventually stop.

AnalysisAI

Infinite-loop hang in the Linux kernel's nvmem ONIE TLV layout driver causes a local denial-of-service when the EEPROM contains unknown or vendor-specific entry types. Affected kernels from the 6.4 series through multiple stable branches fail to advance the offset pointer when an unrecognized TLV type is encountered, leaving the parser stuck indefinitely. No public exploit or active exploitation (CISA KEV) has been identified; with an EPSS of 0.16% at the 5th percentile, real-world exploitation risk is very low and limited to systems with specific hardware configurations.

Technical ContextAI

The ONIE (Open Network Install Environment) TLV (Type-Length-Value) NVMEM layout driver parses structured EEPROM data found on networking hardware. The driver iterates over sequential TLV entries; each iteration is expected to advance an offset pointer by the entry's length plus header size. The bug, logically equivalent to CWE-835 (Loop with Unreachable Exit Condition), occurs when the parser encounters a type code outside its recognized set - the offset is never incremented, causing the loop to re-process the same byte indefinitely. The triggering example is a vendor-specific entry of type 0x41. The fix adds an unconditional offset increment for unrecognized types so parsing always progresses. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The CWE field is listed as N/A in NVD, which appears to be an oversight; the root cause is clearly an infinite loop via a missing fallthrough case in the type-dispatch logic.

RemediationAI

Upgrade to a patched Linux kernel: 6.6.143 or later in the 6.6 LTS series, 6.12.94 or later in the 6.12 LTS series, 6.18.36 or later in the 6.18 series, 7.0.13 or later in the 7.0 series, or any 7.1+ release. The upstream fix commits are listed in the References section and have been backported across stable trees. If an immediate kernel upgrade is not feasible and the system uses hardware with ONIE TLV EEPROMs, a compensating control is to blacklist or prevent auto-loading of the onie-tlv nvmem layout kernel module (e.g., adding 'blacklist nvmem_layout_onie_tlv' to /etc/modprobe.d/); the trade-off is that EEPROM-based platform data sourced from the ONIE layout will be unavailable to dependent drivers. Systems not using ONIE-compliant networking hardware are not exposed and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53336 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy