Skip to main content

Linux Kernel CVE-2026-53354

| EUVDEUVD-2026-40988 HIGH
2026-07-01 Linux GHSA-j98r-r99h-p736
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
4.2 MEDIUM

Local unprivileged code (AV:L/PR:L) must win a hardware timing race on specific Arm silicon (AC:H); stale data can cross a privilege boundary (S:C) with limited disclosure/integrity impact and no availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 18, 2026 - 08:23 vuln.today
CVSS changed
Jul 18, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

arm64: errata: Mitigate TLBI errata on various Arm CPUs

A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry.

These errata ONLY affect the completion of memory accesses which have been translated by an invalidated TLB entry, and these errata DO NOT affect the actual invalidation of TLB entries. TLB entries are removed correctly.

This issue has been assigned CVE ID CVE-2025-10263.

To mitigate this issue, Arm recommends that software follows any affected TLBI;DSB sequence with an additional TLBI;DSB, which will ensure that all memory write effects affected by the first TLBI have been globally observed. The additional TLBI can use any operation that is broadcast to affected CPUs, and the additional DSB can use any option that is sufficient to complete the additional TLBI.

The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate the issue. Enable this workaround for affected CPUs, and update the silicon errata documentation accordingly.

Note that due to the manner in which Arm develops IP and tracks errata, some CPUs share a common erratum number.

AnalysisAI

Memory-coherency weakness in the arm64 Linux kernel affects systems running on certain Arm-designed CPUs whose TLB errata allow a broadcast TLBI;DSB invalidation sequence to complete before writes translated by the invalidated entry are globally observed. Because stale data can be read after software believes the invalidation and memory barrier have completed, a local low-privileged process could observe memory it should not, matching the 'Information Disclosure' tag. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and the fix is a kernel software mitigation (ARM64_WORKAROUND_REPEAT_TLBI) rather than a microcode change. Note the description internally cross-references CVE-2025-10263, indicating this record (CVE-2026-53354) is a related/duplicate assignment for the same Arm erratum.

Technical ContextAI

The issue lives in the arm64 architecture code of the Linux kernel, specifically its TLB (Translation Lookaside Buffer) invalidation path. On affected Arm CPUs, the broadcast TLB Invalidate (TLBI) followed by a Data Synchronization Barrier (DSB) - the standard sequence software uses to guarantee that page-table changes are visible before proceeding - can retire before memory writes governed by the just-invalidated TLB entry are globally observed by other cores. Critically, the errata do NOT corrupt the invalidation itself: TLB entries are removed correctly; only the ordering/completion guarantee for previously-translated memory accesses is violated. Arm's recommended fix, adopted here, is to follow the affected TLBI;DSB with an additional TLBI;DSB so the second barrier forces global observation of the first's write effects; the kernel already had ARM64_WORKAROUND_REPEAT_TLBI infrastructure, which is simply enabled for the newly-identified CPUs and reflected in the silicon errata documentation. No CWE was assigned; the closest root-cause class is incorrect synchronization / stale-data observation across a coherency window rather than a classic memory-safety bug.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1.1 (mainline 7.2-rc1), whichever matches your branch - which enables the ARM64_WORKAROUND_REPEAT_TLBI mitigation for the affected Arm CPUs; the fixes are available as kernel.org stable commits (e.g. https://git.kernel.org/stable/c/925058203229403008d77a52b1e63e2ae5f4a3cf) and summarized at https://nvd.nist.gov/vuln/detail/CVE-2026-53354 and https://vuldb.com/vuln/375529. Because the mitigation is a software workaround compiled into the kernel, rebuilding or upgrading the kernel is the only real fix; there is no runtime configuration toggle and no microcode substitute. If you cannot patch immediately, compensating controls are limited to reducing exposure of untrusted local code execution on affected arm64 hosts - for example restricting the ability of untrusted tenants/users to run native code on bare-metal or paravirtualized guests on the affected silicon - accepting the trade-off that this does not address trusted-but-buggy workloads and offers no protection where local code execution is inherent to the workload. The repeat-TLBI workaround itself carries a minor performance cost on the extra invalidation/barrier, which is the expected side effect of enabling it.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-53354 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy