Skip to main content

Linux Kernel EUVDEUVD-2026-38977

| CVE-2026-53109 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-r4jc-xrhv-v4rj
Information Disclosure Linux Google Use After Free Memory Corruption IBM
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local unprivileged shell on PowerPC Hash-MMU host
  2. Delivery
    Allocate PTE fragment then madvise MADV_COLLAPSE on shmem
  3. Exploit
    Leave cached fragment folio with residual refcount
  4. Execution
    Exit process racing parallel folio free
  5. Persist
    Kernel frees still-active folio
  6. Impact
    Bad page state / memory corruption

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local code execution on a PowerPC (IBM POWER) kernel built with the Hash MMU and 64K page size - the specific configuration where a 64K folio holds 16 PTE fragments. The trigger path requires a local process to allocate a PTE fragment from a folio, exercise madvise MADV_COLLAPSE on a shmem range (invoking pte_free_defer() and its active-flag/RCU logic), leave residual unused fragments in the cached mm->context pte_frag, and then exit - with a parallel folio free racing the teardown. Limiting factors: exploitation is NOT possible on the Radix MMU or on non-PowerPC architectures; it demands local (not network) access, requires the timing-sensitive race between fragment freeing and process exit rather than a deterministic single step, and is confined to a niche hardware/MMU configuration, which sharply narrows realistic exposure despite the AV:L/PR:L rating.
Impact

Signals are consistent that this is a low-to-moderate real-world priority despite a CVSS base of 7.8. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N indicates local, low-privilege access with high C/I/A impact, but the description makes clear exploitation depends on a timing-sensitive corner case (a cached fragment folio with leftover refcount racing a parallel process exit) rather than the deterministic AC:L the published vector implies - the effective attack complexity is higher than AC:L suggests. EPSS is very low (0.16%, 6th percentile) and the CVE is not on CISA KEV, so there is no evidence of active exploitation; no POC is referenced. The published C:H/I:H/A:H rating is optimistic for what is described as a bad-page-state condition whose most reliable outcome is a kernel BUG/instability; broader memory corruption is plausible (tags include 'Memory Corruption' and 'Use After Free') but not demonstrated. Net: a legitimate kernel hygiene fix, but realistic risk is confined to PowerPC/Hash-MMU deployments and is unlikely to be widely weaponized.
Exploit ScenarioDerived

A local unprivileged user on an IBM POWER system running a Hash-MMU 64K-page kernel runs a program that allocates PTE fragments and issues madvise(MADV_COLLAPSE) against a shmem range, leaving a cached fragment folio with a nonzero refcount; on process exit the kernel frees that still-active folio and hits the bad-page state, corrupting allocator state and potentially crashing the system. No public exploit code is identified at time of analysis, and the timing-dependent nature (AC realistically higher than the published AC:L) makes reliable triggering non-trivial.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Use-after-free / bad page state in the Linux kernel's PowerPC page-table fragment allocator (powerpc/pgtable-frag) allows a local user on affected POWER systems to trigger kernel memory corruption and instability during process teardown. The flaw manifests when a cached PTE fragment folio retains an unused reference at process exit, so pte_frag_destroy() frees the folio without clearing its active flag, producing a PAGE_FLAGS_CHECK_AT_FREE bad-page state. There is no public exploit identified at time of analysis and EPSS is very low (0.16%, 6th percentile); a vendor patch is available.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel - 6.18.33, 7.0.10, or 7.1 (or your distribution's equivalent), applying the upstream stable commits c8b710655012a2993a9567873fb71a8a51f8459c / a32db6fca3c74b4eb8bae5470f0680deb4cbac6f / fda4d71651f71c44b35829d13f3c8bf920032f77. Ubuntu users should install the kernel updates in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1) and reboot. There is no clean runtime workaround since the flaw is in core page-table teardown; on PowerPC systems where patching must be deferred, the exposure can be reduced by restricting local shell/code execution to trusted users (the trigger requires local processes exercising MADV_COLLAPSE on shmem), and non-PowerPC or non-Hash-MMU (Radix MMU) deployments are effectively unaffected and can be deprioritized. Rebooting into the patched kernel is required for the fix to take effect.

Affected VersionsENISA

Linux 6.6
Linux patch: 0
Linux patch: 7.0.10
Linux 32cc0b7c9d508efde8946a82eb3c4acfa8dfed15 <a32db6fca3c74b4eb8bae5470f0680deb4cbac6f
Linux patch: 6.18.33
Linux patch: 7.1
Linux 32cc0b7c9d508efde8946a82eb3c4acfa8dfed15 <c8b710655012a2993a9567873fb71a8a51f8459c
Linux 32cc0b7c9d508efde8946a82eb3c4acfa8dfed15 <fda4d71651f71c44b35829d13f3c8bf920032f77

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is powerpc's page-table fragment management, which packs multiple small page tables into a single folio - for the Hash MMU with 64K page size, one 64K page holds 16 separate 4K PTE tables tracked by a pt_frag_refcount reference counter. The bug (CWE-416, Use After Free) was exposed by the pte_free_defer()/RCU deferred-freeing series added for madvise MADV_COLLAPSE on shmem, which sets a folio 'active' flag to signal RCU-deferred freeing. The CPE data (cpe:2.3:a:linux:linux) identifies the generic Linux kernel, but the vulnerable code path is architecture-specific: only PowerPC (IBM POWER, reproduced on emulated POWER10/pSeries) using the Hash MMU with 64K pages exercises this fragment/active-flag logic. The root cause is that the do_exit()→arch_exit_mmap()→pte_frag_destroy() teardown path calls pagetable_dtor()/pagetable_free() directly without clearing the residual active flag, so the folio is freed while still flagged, tripping the page allocator's free-time flag checks.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Local unprivileged trigger but a timing-dependent race (AC:H); impact is chiefly a kernel bad-page crash (A:H) with only limited corruption/disclosure (C:L/I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy

powerpc uses pt_frag_refcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 64K pagesize, we have 16 fragments of 4K size in one 64K page.

Patch series [1] "mm: free retracted page table by RCU" added pte_free_defer() to defer the freeing of PTE tables when retract_page_tables() is called for madvise MADV_COLLAPSE on shmem range. [1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/

pte_free_defer() sets the active flag on the corresponding fragment's folio & calls pte_fragment_free(), which reduces the pt_frag_refcount. When pt_frag_refcount reaches 0 (no active fragment using the folio), it checks if the folio active flag is set, if set, it calls call_rcu to free the folio, it the active flag is unset then it calls pte_free_now().

Now, this can lead to following problem in a corner case...

[ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62 [ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62 [ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff) [ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000 [ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000 [ 265.361438][ T183] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set [ 265.362572][ T183] Modules linked in: [ 265.364622][ T183] CPU: 0 UID: 0 PID: 183 Comm: a.out Not tainted 6.18.0-rc3-00141-g1ddeaaace7ff-dirty #53 VOLUNTARY [ 265.364785][ T183] Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries [ 265.364908][ T183] Call Trace: [ 265.364955][ T183] [c000000011e6f7c0] [c000000001cfaa18] dump_stack_lvl+0x130/0x148 (unreliable) [ 265.365202][ T183] [c000000011e6f7f0] [c000000000794758] bad_page+0xb4/0x1c8 [ 265.365384][ T183] [c000000011e6f890] [c00000000079c020] __free_frozen_pages+0x838/0xd08 [ 265.365554][ T183] [c000000011e6f980] [c0000000000a70ac] pte_frag_destroy+0x298/0x310 [ 265.365729][ T183] [c000000011e6fa30] [c0000000000aa764] arch_exit_mmap+0x34/0x218 [ 265.365912][ T183] [c000000011e6fa80] [c000000000751698] exit_mmap+0xb8/0x820 [ 265.366080][ T183] [c000000011e6fc30] [c0000000001b1258] __mmput+0x98/0x300 [ 265.366244][ T183] [c000000011e6fc80] [c0000000001c81f8] do_exit+0x470/0x1508 [ 265.366421][ T183] [c000000011e6fd70] [c0000000001c95e4] do_group_exit+0x88/0x148 [ 265.366602][ T183] [c000000011e6fdc0] [c0000000001c96ec] pid_child_should_wake+0x0/0x178 [ 265.366780][ T183] [c000000011e6fdf0] [c00000000003a270] system_call_exception+0x1b0/0x4e0 [ 265.366958][ T183] [c000000011e6fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec

The bad page state error occurs when such a folio gets freed (with active flag set), from do_exit() path in parallel.

... this can happen when the pte fragment was allocated from this folio, but when all the fragments get freed, the pte_frag_refcount still had some unused fragments. Now, if this process exits, with such folio as it's cached pte_frag in mm->context, then during pte_frag_destroy(), we simply call pagetable_dtor() and pagetable_free(), meaning it doesn't clear the active flag. This, can lead to the above bug. Since we are anyway in do_exit() path, then if the refcount is 0, then I guess it should be ok to simply clear the folio active flag before calling pagetable_dtor() & pagetable_free().

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's PowerPC memory manager (CVE-2026-53109) can cause kernel memory corruption and system instability on POWER architecture servers during process cleanup. While the technical severity is rated high, real-world exploitation risk is minimal-a vendor patch is available, no public exploit exists, and the vulnerability requires local system access. Organizations running POWER systems should prioritize patching, but can operate safely in the interim with standard access controls.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
Linux is ubiquitous, but this path only affects niche PowerPC Hash-MMU 64K builds
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53109 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373360 REF https://git.kernel.org/stable/c/a32db6fca3c74b4eb8bae5470f0680deb4cbac6f REF https://git.kernel.org/stable/c/c8b710655012a2993a9567873fb71a8a51f8459c REF https://git.kernel.org/stable/c/e9d197c248e70278645f206defa87f085826c4c1 REF https://git.kernel.org/stable/c/f4bc93135bfe39e7052d31e4c71f5f838e0bf516 REF https://git.kernel.org/stable/c/fda4d71651f71c44b35829d13f3c8bf920032f77

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy