Skip to main content

Linux Kernel EUVDEUVD-2026-39228

| CVE-2026-53277 HIGH
Missing Synchronization (CWE-820)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fgxj-vfg7-cpqq
Linux Code Injection
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Run malicious guest on arm64 KVM host
  2. Delivery
    Invoke AT emulation or nested stage-2 walk
  3. Exploit
    Concurrently force memslot reconfiguration
  4. Execution
    Win race against unlocked SRCU walk
  5. Persist
    Trigger host use-after-free / corruption
  6. Impact
    Crash host or influence host memory

Vulnerability Assessment

Weakness
CWE
CWE-820
ASVS 5.0
V15 - Secure Coding and Architecture Missing synchronization
Exploitation Conditions

Exploitation requires local execution as a KVM guest on an arm64 host whose kernel exercises the unlocked paths - specifically AT-instruction emulation via __kvm_at_s12() or the nested stage-2 walker kvm_walk_nested_s2() (i.e., nested virtualization enabled). The attacker must also win a timing race against concurrent memslot changes, since the bug is a missing kvm->srcu read lock rather than a deterministic flaw. Limiting factors: it does not apply to x86 or other architectures, does not apply to hosts that never invoke AT emulation or nested KVM, needs the privilege to run/configure a guest (PR:L), and the race condition makes single-shot exploitation unreliable. There is no remote, unauthenticated path.
Impact

Signals are mixed and lean toward lower real-world urgency than the 8.8 base score suggests. The vendor CVSS (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a local guest-to-host scope-changing impact, but AC:L is questionable for a memslot race that an attacker must win against another thread reconfiguring memory - this analysis treats it as high attack complexity. EPSS is low (0.17%, 7th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and exploitation is further gated by needing an arm64 host that actually exercises AT emulation or nested KVM. The most likely practical outcome of the race is a host-side use-after-free or crash (denial of service) rather than reliable code execution. Net: a legitimate hardening fix worth patching on multi-tenant arm64 virtualization hosts, but not an emergency for the general fleet; the 'Code Injection' tag and full CIA-High rating overstate the demonstrated impact relative to the description, which only documents a missing lock - verify exploitability with the kernel maintainers before treating it as RCE.
Exploit ScenarioDerived

An attacker who controls a guest VM (or a nested guest) on a vulnerable arm64 KVM host triggers AT-instruction emulation or a nested stage-2 walk while simultaneously forcing rapid memslot reconfiguration, racing the unlocked page-table walk against the memslot change. Winning the race corrupts or dereferences freed host memory, most plausibly crashing the host or, in a best case for the attacker, manipulating host memory state. No public proof-of-concept is available, and the local attack vector plus race timing make reliable exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation / host compromise risk in the Linux kernel arm64 KVM subsystem arises because __kvm_at_s12() (AT instruction emulation) and __kvm_find_s1_desc_level() invoke the stage-1/nested stage-2 page-table walkers walk_s1() and kvm_walk_nested_s2() without holding kvm->srcu, which those walkers require to guard against concurrent memslot changes. A malicious or compromised guest on an affected arm64 host can race memslot updates against these walks, with CVSS scoring confidentiality, integrity and availability all High under a changed scope (host impact). It is patched in stable trees, EPSS is low (0.17%), and there is no public exploit identified at time of analysis.

RemediationAI

Apply the stable-kernel update that contains the SRCU fix: upgrade to a patched build such as 6.18.36, 7.0.13, or 7.1 for the corresponding series (Vendor-released patch confirmed; pull the exact stable tag matching your tree). The change is contained in commits https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc, https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39, and https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251, so distribution kernels can be matched against these. There is no in-kernel toggle that disables only the buggy code paths, but because exposure is limited to arm64 KVM hosts, compensating controls until patching include not running untrusted or multi-tenant guests on affected arm64 hypervisors and avoiding nested virtualization on those hosts (trade-off: nested KVM and some guest features become unavailable); on non-arm64 or non-KVM systems no action is required. Reference the EUVD/NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53277 for tracking.

Affected VersionsENISA

Linux be04cebf3e78874627dc1042991d5d504464a5cc <97706097f9b851cfe55c3b00b083dfc2bcf542bc
Linux patch: 6.18.36
Linux 6.12
Linux patch: 7.1
Linux patch: 0
Linux be04cebf3e78874627dc1042991d5d504464a5cc <f2ca45b50d4216c9cc7ffabf50d9ad1932209251
Linux patch: 7.0.13
Linux be04cebf3e78874627dc1042991d5d504464a5cc <ec42b4ed1b072ea2d03f086061aa67bad6d8de39

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in KVM on arm64, the kernel's hardware virtualization layer. SRCU (Sleepable RCU) is the synchronization primitive KVM uses to publish memslot (guest-physical to host-virtual memory mapping) configurations; readers that walk guest page tables must hold kvm->srcu so a concurrent memslot update cannot free or remap structures mid-walk. Two callers - __kvm_at_s12(), which emulates the Address Translation (AT) instructions for stage-1 and stage-2 translation, and __kvm_find_s1_desc_level(), used in fault injection / descriptor lookup - entered walk_s1() and kvm_walk_nested_s2() (the nested-virtualization stage-2 walker) without acquiring that lock. The root cause is a missing-lock / race-condition class defect (no CWE was assigned in the feed; this is effectively CWE-667 Improper Locking / CWE-362 race condition), not the 'Code Injection' label applied by an automated tagger. The fix simply wraps both walks in kvm->srcu read-side critical sections.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local guest access (AV:L) with privilege to run a VM (PR:L); a memslot race raises complexity to AC:H; host impact across the VM boundary gives S:C with high CIA from potential UAF.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation

walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking kvm->srcu.

Fix by acquiring kvm->srcu prior to the table walk in both instances.

Executive ViewAI

Why It Matters

CVE-2026-53277 affects the Linux kernel arm64 KVM subsystem, allowing guest virtual machines to escalate privileges and compromise the hypervisor host. Organizations running multi-tenant virtualized workloads on ARM-based Linux infrastructure face isolation breaches and potential cross-tenant confidentiality violations. While no public exploit is currently identified, the vulnerability enables full host takeover with high impact to confidentiality, integrity, and availability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
High
Linux kernel is ubiquitous, but vulnerable arm64 KVM/nested-virt hosts are a narrow subset
Vendor Action
See Below
Not affected (vendor confirmed)
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Same weakness CWE-820 – Missing Synchronization

View all
CVE-2026-70637 HIGH POC
8.2
CVE-2025-47154 CRITICAL
9.0
CVE-2025-1445 HIGH
8.7
CVE-2026-53153 HIGH
7.8
CVE-2026-22163 HIGH
7.8
CVE-2024-49114 HIGH
7.8
CVE-2022-50238 HIGH
7.4
CVE-2024-30387 HIGH
7.1

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53277 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373829 REF https://access.redhat.com/errata/RHSA-2026:64775 REF https://access.redhat.com/security/cve/CVE-2026-53277 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492725 REF https://git.kernel.org/stable/c/0648b375aa951cc15d9e90f9ac4de71e0b51fa45 REF https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc REF https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39 REF https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53277.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy