Skip to main content

Linux Kernel EUVDEUVD-2026-39244

| CVE-2026-53153 HIGH
Missing Synchronization (CWE-820)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-x5g3-hx3c-gfxx
Information Disclosure Linux Red Hat Enterprise Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged access
  2. Delivery
    Create and destroy memory cgroups
  3. Exploit
    Trigger concurrent list_lru_del during reparent
  4. Execution
    Win race to corrupt list pointers
  5. Persist
    Kernel panic or memory-corruption primitive
  6. Impact
    Denial of service or privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-820
ASVS 5.0
V15 - Secure Coding and Architecture Missing synchronization
Exploitation Conditions

Requires local code execution on the host and the ability to create/destroy memory cgroups (memcg) - e.g., via delegated cgroup v2 subtrees or unprivileged user namespaces - so that memcg_reparent_list_lrus() runs while the attacker concurrently drives list_lru_del() or list_lru_walk_one() operations against the dying cgroup. Exploitation is gated by winning a tight race window between clearing the xarray entry and reparenting the per-node lists, which limits reliability; it also requires kernel 6.13 or later (containing the introducing commit fb56fdf8b9a2) and is not exploitable remotely or without local access. PR:L per the published vector indicates some privilege is needed, consistent with cgroup manipulation rights rather than full root.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) reflects a local, low-privilege flaw with high impact, consistent with kernel memory corruption that can lead to denial of service or potential privilege escalation. However, the practical exploitability is meaningfully lower than the raw score suggests: this is a narrow race window requiring an attacker to win a timing condition during cgroup teardown concurrent with list_lru operations, which is non-trivial to control - the published AC:L likely understates the real attack complexity (a more defensible assessment is AC:H). EPSS of 0.17% (7th percentile) and the absence of any public PoC or KEV listing indicate no observed exploitation and low near-term weaponization likelihood. The 'Information Disclosure' tag in the intelligence feed appears mislabeled - the described primitive is linked-list corruption (integrity/availability), not a read primitive; treat that tag with caution. Net: a legitimate but lower-priority kernel hardening fix for most environments, more relevant where untrusted local users or containers can create/destroy memory cgroups.
Exploit ScenarioDerived

A local unprivileged or low-privileged user repeatedly creates and destroys memory cgroups while simultaneously generating heavy reclaimable-object churn (e.g., dentry/inode pressure) to force concurrent list_lru_del operations during reparenting. By winning the race window, the attacker corrupts kernel linked-list pointers, causing a kernel panic (DoS) or, with sufficient heap-grooming control, a memory-corruption primitive that could be developed toward privilege escalation. No public PoC is currently known.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Kernel memory corruption in the Linux memory-management list_lru subsystem (memory cgroup reparenting path) allows a local user to corrupt linked-list pointers and destabilize or potentially escalate privileges on the system. The flaw is a race condition in memcg_reparent_list_lrus(), affecting kernels from 6.13 onward; it carries CVSS 7.8 (High) with full confidentiality, integrity and availability impact but a low EPSS of 0.17% (7th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Upstream fix available (commits), released patched version reported by EUVD as 6.18.36 and 7.0.13 on their respective stable branches - upgrade to a stable kernel that contains commit 2b66496d794e98f7aeec7688573051f22ec40bac, 98733f3f0becb1ae0701d021c1748e974e5fa55c, or c19ff4351214f059349788e13e70e74325831ff6 as appropriate to your branch (see https://git.kernel.org/stable/c/2b66496d794e98f7aeec7688573051f22ec40bac and the two sibling commits). Apply your distribution's kernel security update once it ships the backport and reboot. As a compensating control where immediate patching is impossible, restrict the ability of untrusted local users and containers to create and tear down memory cgroups (e.g., constrain delegated cgroup subtrees and limit unprivileged user namespaces via sysctl such as kernel.unprivileged_userns_clone=0), which reduces the attacker's ability to drive rapid memcg reparenting - at the cost of breaking rootless container and nested-cgroup workflows that legitimately rely on those features. No reliable in-kernel runtime workaround exists short of the code fix.

Affected VersionsENISA

Linux patch: 7.1
Linux patch: 0
Linux fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af <2b66496d794e98f7aeec7688573051f22ec40bac
Linux 6.13
Linux patch: 6.18.36
Linux fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af <98733f3f0becb1ae0701d021c1748e974e5fa55c
Linux fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af <c19ff4351214f059349788e13e70e74325831ff6
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the kernel's list_lru infrastructure (mm/list_lru.c), a per-memcg, per-node LRU list mechanism used for reclaimable kernel objects (e.g., dentry/inode shrinker caches) tracked per memory cgroup. When a memory cgroup dies, memcg_reparent_list_lrus() migrates its per-node lists into the parent cgroup. The original code cleared the dying memcg's xarray entry with xas_store(&xas, NULL) BEFORE reparenting the lists, opening a TOCTOU window: a concurrent list_lru_del() that observed xa_load()==NULL would walk to the parent, take the parent's per-node lock, and call list_del_init() on an item still physically linked on the dying memcg's list - while another thread holding the dying memcg's per-node lock manipulated the same physical list under a different lock, corrupting ->next/->prev pointers. The root-cause class is a concurrency/race condition (CWE-362, leading to CWE-787 out-of-bounds/linked-list corruption), even though NVD records the CWE as N/A. The fix reverses ordering: reparent each list and mark the child list_lru dead first, then clear the xarray entry, so any concurrent op either synchronizes on the dying memcg's lock or correctly finds the items in the parent.

Know when Enterprise Linux gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local access and cgroup-manipulation privileges give AV:L/PR:L; winning a narrow reparent race window justifies AC:H; kernel list corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/list_lru: drain before clearing xarray entry on reparent

memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list.

If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links.

Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.

Executive ViewAI

Why It Matters

Linux kernel versions 6.13 and later contain a high-severity privilege escalation vulnerability that could allow local users to compromise system security, availability, and data confidentiality. All organizations operating these Linux kernels must apply available patches immediately to prevent unauthorized system access and compromise.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel runs across the vast majority of server and cloud deployments
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Enterprise Linux

View all
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Same weakness CWE-820 – Missing Synchronization

View all
CVE-2026-70637 HIGH POC
8.2
CVE-2025-47154 CRITICAL
9.0
CVE-2026-53277 HIGH
8.8
CVE-2025-1445 HIGH
8.7
CVE-2026-22163 HIGH
7.8
CVE-2024-49114 HIGH
7.8
CVE-2022-50238 HIGH
7.4
CVE-2024-30387 HIGH
7.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53153 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373794 REF https://access.redhat.com/errata/RHSA-2026:61887 REF https://access.redhat.com/security/cve/CVE-2026-53153 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492790 REF https://git.kernel.org/stable/c/2b66496d794e98f7aeec7688573051f22ec40bac REF https://git.kernel.org/stable/c/98733f3f0becb1ae0701d021c1748e974e5fa55c REF https://git.kernel.org/stable/c/c19ff4351214f059349788e13e70e74325831ff6 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53153.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy