Skip to main content

Linux Kernel CVE-2026-53343

| EUVDEUVD-2026-40977 MEDIUM
2026-07-01 Linux GHSA-4f2p-2mpv-gjwq
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects co-requisite ARMv5 hardware plus both KASAN_VMALLOC and VMAP_STACK configs; no C or I impact exists.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:52 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow

Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow") added a dummy read from the KASAN VMAP stack shadow in __switch_to(). The read uses ldr, but the KASAN shadow address is byte-granular and is not guaranteed to be word aligned.

ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to() with an alignment exception before reaching init.

Use ldrb for the dummy shadow access. The code only needs to fault in the shadow mapping if the stack shadow is missing, so a byte load is sufficient and matches the granularity of KASAN shadow memory.

AnalysisAI

CVE-2026-53343 causes a deterministic boot-time kernel panic on ARMv5-class Linux systems (ARM926/VersatilePB) with KASAN VMAP stack instrumentation enabled. A word-sized ldr instruction introduced by commit 44e9a3bb76e5 accesses byte-granular KASAN shadow memory without guaranteed word alignment; ARMv5 strictly enforces aligned word loads and raises a data abort, crashing the kernel in __switch_to() before init is reached. No public exploit code exists and EPSS is 0.16% (6th percentile), consistent with the extremely narrow hardware and configuration footprint required.

Technical ContextAI

The bug resides in the 32-bit ARM (arm) kernel entry assembly, specifically in __switch_to(), which handles task context switching. Commit 44e9a3bb76e5 added a dummy ldr (32-bit word load) from the KASAN VMAP shadow region to ensure the shadow page mapping is faulted in before use. KASAN shadow memory is byte-granular - one shadow byte covers eight kernel bytes - so the shadow address derived from a VMAP stack pointer is not guaranteed to be 4-byte aligned. ARMv5 processors such as the ARM926 enforce strict alignment for word loads and generate an alignment exception (data abort) on unaligned ldr accesses; ARMv6+ and ARM64 handle this transparently, explaining why the defect is ARMv5-specific. The kernel fix (ARM: 9475/1) replaces ldr with ldrb (byte load), which carries no alignment requirement and is semantically sufficient to fault in the shadow mapping. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected product. No CWE is assigned by NVD; the root cause class is an incorrect instruction-size selection for a platform with strict alignment semantics.

RemediationAI

Update to a patched kernel release: 6.1.176 or later, 6.6.143 or later, 6.12.94 or later, 7.0.13 or later, 6.18.36 or later, or 7.1 with the stable fix applied. Stable-tree fix commits are available at https://git.kernel.org/stable/c/ per the references. For systems that cannot be immediately patched, disabling CONFIG_KASAN_VMALLOC in the kernel build config and rebuilding eliminates the vulnerable code path entirely; the trade-off is loss of KASAN coverage for vmalloc/VMAP regions, which is acceptable in any non-kernel-development environment. Alternatively, disabling CONFIG_VMAP_STACK removes the VMAP stack infrastructure that creates the misaligned shadow addresses, but disables stack overflow protection - less preferred. Because KASAN is not enabled in typical production kernels, most production ARM deployments do not require immediate action and should confirm their build configuration before prioritising this issue.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53343 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy