Skip to main content

Linux Kernel EUVDEUVD-2026-39216

| CVE-2026-53265 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-257g-7vrp-j9f8
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local low-priv access (AV:L/PR:L); race timing makes AC:H; impact is memory corruption causing integrity/availability loss (I:H/A:H) with no real disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:48 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm cache policy smq: check allocation under invalidate lock

commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section.

That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check.

This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again.

Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock.

AnalysisAI

Local privilege-escalation/memory-corruption in the Linux kernel device-mapper dm-cache 'smq' policy allows a low-privileged local user to trigger a check-then-act race in smq_invalidate_mapping(). The e->allocated predicate was evaluated outside mq->lock, so two concurrent cache-block invalidators can both see an entry as allocated and free it twice, corrupting the SMQ queues/hash table and tripping the allocation assertion in free_entry(). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile); the issue is not listed in CISA KEV.

Technical ContextAI

The flaw lives in the Linux kernel's device-mapper (dm) caching subsystem, specifically the Stochastic Multiqueue (smq) cache replacement policy used by the dm-cache target to manage which blocks live on the fast cache device versus the slow origin device. smq tracks cache blocks via per-entry state (struct entry, including e->allocated), multiple priority queues, and a hash table, all protected by mq->lock. The root cause is a concurrency defect (CWE-362 race condition leading to CWE-415 double-free / CWE-416 use-after-free): commit 2d1f7b65f5de added locking around the destructive portion of smq_invalidate_mapping() but left the e->allocated read outside the critical section, breaking serialization between the predicate and the queue/hash mutation plus free_entry() call. Because the description identifies no CVE-assigned CWE, the weakness class is inferred from the code behavior, not from a vendor CWE mapping.

RemediationAI

Apply the vendor-released stable kernel update for your tree: upgrade to 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13 (or later) as appropriate, which moves the e->allocated allocation check under mq->lock so the predicate and destructive operations are serialized. The fix is available as tagged stable releases and as upstream commits at https://git.kernel.org/stable/c/d3f0a606b9f278ece8a0df626ded9c4044071235 and the related stable commits referenced in NVD; distribution users should pull the corresponding distro kernel errata. If immediate patching is not possible, the most direct compensating control is to avoid the vulnerable code path by not deploying dm-cache with the smq policy (e.g., reconfigure caches to a non-affected policy or remove dm-cache acceleration), accepting the trade-off of reduced or eliminated cache tiering performance; additionally restrict which local accounts can administer or trigger device-mapper/dm-cache operations, accepting reduced operational flexibility for storage management. Reboot is required for the new kernel to take effect.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39216 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy