Skip to main content

Linux Kernel CVE-2026-53342

| EUVDEUVD-2026-40976 MEDIUM
2026-07-01 Linux GHSA-w39q-f6gf-xv3r
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Memory hot-remove requires CAP_SYS_ADMIN (PR:H) and ARM64 hardware with hot-plug memory support (AC:H); no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:51 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

arm64: mm: call pagetable dtor when freeing hot-removed page tables

Since 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()") page-table allocation on ARM64 always calls pagetable_{pte,pmd,pud,p4d}_ctor(). This sets the page_type to PGTY_table, increments NR_PAGETABLE and possible allocates a PTL. However the matching pagetable_dtor() calls were never added.

With DEBUG_VM enabled on kernel versions prior to v6.17 without 2dfcd1608f3a9 ("mm/page_alloc: let page freeing clear any set page type") this leads to the following warning when freeing these pages due to page->page_type sharing page->_mapcount:

BUG: Bad page state in process ... pfn:284fbb page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff) page_type: f2(table) page dumped because: nonzero mapcount Call trace: bad_page+0x13c/0x160 __free_frozen_pages+0x6cc/0x860 ___free_pages+0xf4/0x180 free_pages+0x54/0x80 free_hotplug_page_range.part.0+0x58/0x90 free_empty_tables+0x438/0x500 __remove_pgd_mapping.constprop.0+0x60/0xa8 arch_remove_memory+0x48/0x80 try_remove_memory+0x158/0x1d8 offline_and_remove_memory+0x138/0x180

It can also lead to leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS is defined and incorrect NR_PAGETABLE stats. Fix this by calling pagetable_dtor() in free_hotplug_pgtable_page() prior to freeing the page to undo the effects of calling pagetable_*_ctor().

AnalysisAI

Missing pagetable destructor calls in the ARM64 memory management subsystem cause kernel instability and resource leaks during memory hot-remove operations. Since commit 5e8eb9aeeda3, ARM64 page-table allocation unconditionally invokes pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() teardown was never added to the hot-remove path (free_hotplug_pgtable_page()), leaving PGTY_table type flags set and potentially leaking PTL allocations. No public exploit has been identified and EPSS at 0.15% (5th percentile) reflects the narrow exploitation path, though availability impact on affected ARM64 systems is confirmed by kernel maintainers.

Technical ContextAI

The vulnerability lives in arch/arm64/mm, specifically the page-table lifecycle management introduced by commit 5e8eb9aeeda3a7aaf48efa1d34ae804e894e307f ('arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()'). The constructor functions (pagetable_pte_ctor, pagetable_pmd_ctor, etc.) set page->page_type to PGTY_table, increment the NR_PAGETABLE counter, and - when ALLOC_SPLIT_PTLOCKS is configured - allocate a page table lock (PTL). Because page->page_type shares physical storage with page->_mapcount, a page freed with PGTY_table still set triggers bad_page() in the allocator's integrity checks. The root cause is a resource management asymmetry: constructor called unconditionally on alloc, destructor absent on the hot-remove free path. CWE is not formally assigned but maps to CWE-459 (Incomplete Cleanup) or CWE-401 (Missing Release of Memory). CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is upgrading to a patched kernel: 6.18.36, 7.0.13, or 7.1 per EUVD confirmed fix versions. Administrators running upstream stable kernels should apply one of the three fix commits available at https://git.kernel.org/stable/c/95f27fcda681021ed3906d3cae7e68b6a57a1d8e, https://git.kernel.org/stable/c/aaa688ac9f18207f7452c6472e647c1febaea6a3, or https://git.kernel.org/stable/c/c594b83457ccdee76d458416fb3bc9348a37592f. Distribution-packaged kernels (RHEL, Ubuntu, Debian, SUSE ARM64 variants) should be updated as vendor advisories are released. If immediate patching is not feasible, disabling or restricting memory hot-remove operations on ARM64 nodes eliminates the trigger path entirely with no functional impact on systems not relying on NUMA hot-plug; this can be enforced by restricting sysfs write access to /sys/devices/system/memory/*/state. Running kernels v6.17+ with fix 2dfcd1608f3a9 mitigates the visible BUG warning but does not resolve underlying PTL leaks if ALLOC_SPLIT_PTLOCKS is enabled.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53342 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy