Skip to main content

Linux Kernel CVE-2026-53352

| EUVDEUVD-2026-40986 MEDIUM
Race Condition (CWE-362)
2026-07-01 Linux GHSA-hcpv-6hqv-vmx5
Information Disclosure Linux Race Condition
4.7
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local shell access
  2. Delivery
    Launch multi-threaded process in process group
  3. Exploit
    Send SIGSTOP to process group during execve()
  4. Install
    Win race: zap_other_threads() skips clearing caller's JOBCTL flags
  5. C2
    Stale JOBCTL_STOP_PENDING persists post-execve()
  6. Execute
    task_participate_group_stop() decrements zero counter
  7. Impact
    Kernel WARN_ON fires, potential panic

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a local account with at least low-level execution privileges (CVSS PR:L) sufficient to run multi-threaded processes and send signals within a process group. The race condition is triggered when a SIGSTOP (or any group-stop signal) is delivered to a multi-threaded process at the exact moment one of its threads is executing execve() and invoking de_thread()/zap_other_threads(). The attack complexity is rated High (CVSS AC:H) because winning this narrow race window without external timing primitives is difficult. No special kernel configuration, privileged capability, or non-default build option is required - the code path exists in standard kernel builds. What limits exploitation is the combination of mandatory local access, the precise scheduling coincidence required, and the fact that the outcome (kernel warning/panic) is disruptive rather than providing privilege escalation or data exfiltration.
Impact

CVSS 3.1 scores this at 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, which is well-calibrated: local access and low privileges are sufficient, but the High attack complexity reflects the narrow race window that must be won between concurrent signal delivery and execve(). The sole impact is availability - the kernel WARN_ON triggered by the counter underflow can, depending on kernel build options (CONFIG_WARN_ON, panic_on_warn), range from a harmless log entry to a kernel panic. EPSS of 0.16% (6th percentile) signals very low practical exploitation probability, consistent with the timing-dependent nature of the race. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. The 'Information Disclosure' tag in the source intelligence appears to be a tagging error - CVSS C:N confirms no confidentiality impact. Real-world risk is modest: an attacker must already have local shell access, control a multi-threaded process, and win a race condition, making this relevant primarily for hardened environments concerned with local denial-of-service or kernel stability guarantees.
Exploit ScenarioDerived

A local user with shell access launches a multi-threaded application and arranges for a SIGSTOP (or equivalent group stop signal) to be delivered to the process group precisely while one thread is executing execve(). If the race window is won, the calling thread's stale JOBCTL_STOP_PENDING flag survives thread group teardown; upon return to user mode after execve(), the kernel's signal-checking path invokes task_participate_group_stop() against a zero group_stop_count, triggering a kernel WARN_ON that may escalate to a panic depending on kernel configuration. No public proof-of-concept is known, and reliable triggering requires controlling precise scheduling timing.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Race condition in the Linux kernel signal subsystem allows a local low-privileged user to trigger a kernel warning and potential system instability by exploiting a timing window between SIGSTOP delivery and a concurrent execve() call in a multi-threaded process. The calling thread in zap_other_threads() retains stale JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME flags after the thread group is torn down, causing task_participate_group_stop() to decrement an already-zero group_stop_count and fire a kernel WARN_ON. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with a difficult-to-reliably-trigger race.

RemediationAI

Update the Linux kernel to one of the patched stable releases: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, as appropriate for the deployed branch. Patch commits are available directly from the Linux stable tree at git.kernel.org (commit hashes listed in the references section) for operators who build kernels from source. For systems where an immediate kernel upgrade is not feasible, the most effective compensating control is to restrict local user access to prevent untrusted users from executing arbitrary multi-threaded binaries, since the vulnerability requires the ability to launch processes and send signals; this can be achieved via SELinux, AppArmor, or seccomp policies, though these controls reduce but do not eliminate exposure and carry usability trade-offs. The NVD advisory is available at https://nvd.nist.gov/vuln/detail/CVE-2026-53352.

Affected VersionsENISA

Linux 3.0
Linux patch: 6.1.176
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <90918794a4e2c3b440f8fcf3847765a8b1d81b25
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <f8d720bc2e35d568c18be0644e92a468de428370
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <f4aae11abb449dc536269705d0419ec69480faa9
Linux patch: 6.18.36
Linux patch: 5.10.259
Linux patch: 6.12.94
Linux patch: 7.1
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <2b32b2fb241435145ea199efac024540759d2495
Linux patch: 5.15.210
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <dfcd0ba14769d94d76ac9d9814b85e7fcacd4e29
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <8c046f36222c6ce1e0daef2c45c891c72602f8a1
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <391ebe74456a0f1d60b3ba4a8a64d9f44c1728fe
Linux 39efa3ef3a376a4e53de2f82fc91182459d34200 <76aebd9ef20078719dfd6282d3b06c27e900a65a
Linux patch: 6.6.143
Linux patch: 7.0.13
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in kernel/signal.c within the zap_other_threads() function, which is invoked by de_thread() during execve() to kill all threads in a multi-threaded process. The Linux job control subsystem uses JOBCTL_PENDING_MASK - a bitmask covering JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME - to coordinate group stop participation across threads. When a SIGSTOP arrives, do_signal_stop() sets these flags on all threads and increments signal->group_stop_count. zap_other_threads() correctly clears these flags for all other threads but omits the calling thread, leaving stale flags that cause task_participate_group_stop() to under-decrement the counter. CWE-362 (Race Condition / Concurrent Execution Using Shared Resource with Improper Synchronization) precisely classifies this flaw: two concurrent kernel paths - signal delivery and execve - share job control state without adequate synchronization for the caller's own flags. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from commit 39efa3ef3a376a4e53de2f82fc91182459d34200 onward until the respective stable-branch fixes.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Local access with low privileges required to launch processes; High complexity reflects the narrow race window; only availability impacted via kernel warning or panic.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 22, 2026 - 19:22 NVD
4.7 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 4.7

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets signal->group_stop_count to the number of threads. If one of the threads concurrently calls execve(), de_thread() invokes zap_other_threads() to kill all other threads. zap_other_threads() aborts the pending group stop by resetting signal->group_stop_count to 0 and clears the JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the job control flags for the calling thread.

When execve() completes, the calling thread returns to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes task_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the already-zero signal->group_stop_count, triggering a warning:

sig->group_stop_count == 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: <TASK> do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

Fix this race condition by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads(), ensuring it does not retain any stale job control state after the thread group is destroyed. This aligns with other functions that tear down a thread group and abort group stops, such as zap_process() and complete_signal(), which correctly clear these flags for all threads including the current one.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel underlies virtually all Linux server, cloud, and embedded deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

24
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53352 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/375535 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/2b32b2fb241435145ea199efac024540759d2495 REF https://git.kernel.org/stable/c/391ebe74456a0f1d60b3ba4a8a64d9f44c1728fe REF https://git.kernel.org/stable/c/76aebd9ef20078719dfd6282d3b06c27e900a65a REF https://git.kernel.org/stable/c/8c046f36222c6ce1e0daef2c45c891c72602f8a1 REF https://git.kernel.org/stable/c/90918794a4e2c3b440f8fcf3847765a8b1d81b25 REF https://git.kernel.org/stable/c/dfcd0ba14769d94d76ac9d9814b85e7fcacd4e29 REF https://git.kernel.org/stable/c/f4aae11abb449dc536269705d0419ec69480faa9 REF https://git.kernel.org/stable/c/f8d720bc2e35d568c18be0644e92a468de428370

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy