Skip to main content

Linux Kernel EUVDEUVD-2026-39854

| CVE-2026-53319 MEDIUM
Reachable Assertion (CWE-617)
2026-06-26 Linux GHSA-8mp9-p9g8-5rm9
Linux Code Injection Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.3 LOW

Local low-privilege access required; A:L reflects typical non-panic_on_warn deployments where impact is log noise, not system disruption.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 06, 2026 - 20:45 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()

wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from wbt_alloc() and wbt_init(). However, both are expected failure paths:

  • wbt_alloc() can return NULL under memory pressure (-ENOMEM)
  • wbt_init() can fail with -EBUSY if wbt is already registered

syzbot triggers this by injecting memory allocation failures during MTD partition creation via ioctl(BLKPG), causing a spurious warning.

wbt_init_enable_default() is a best-effort initialization called from blk_register_queue() with a void return type. Failure simply means the disk operates without writeback throttling, which is harmless.

Replace WARN_ON_ONCE with plain if-checks, consistent with how wbt_set_lat() in the same file already handles these failures. Add a pr_warn() for the wbt_init() failure to retain diagnostic information without triggering a full stack trace.

AnalysisAI

Spurious WARN_ON_ONCE calls in the Linux kernel's blk-wbt subsystem trigger unnecessary kernel warnings and stack traces under expected failure conditions - memory pressure or a pre-registered writeback throttle. Local low-privileged users can provoke this via ioctl(BLKPG) during MTD partition creation under memory-constrained conditions, generating noise in kernel logs and, on panic_on_warn-enabled kernels, potentially causing a system crash. No public exploit exists and the EPSS score of 0.14% (4th percentile) places this firmly in the low-priority tier; it has not been added to CISA KEV.

Technical ContextAI

The affected code is in the Linux kernel block layer's write-back throttling subsystem (blk-wbt), specifically the function wbt_init_enable_default() called from blk_register_queue() during disk registration. CWE-617 (Reachable Assertion) precisely describes the root cause: WARN_ON_ONCE macros guard code paths that are legitimately reachable - wbt_alloc() can return NULL under -ENOMEM memory pressure, and wbt_init() can return -EBUSY if writeback throttling is already registered. These are expected, non-fatal failure modes, but WARN_ON_ONCE treats them as programmer errors, emitting a full kernel stack trace. On kernels compiled with panic_on_warn, this escalates to a system halt. The syzbot fuzzer confirmed reproduction via memory fault injection during ioctl(BLKPG). The fix aligns the function with how wbt_set_lat() in the same file already handles these cases - plain conditional checks with a targeted pr_warn() for the -EBUSY path. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 7.1 or 7.0.10, which contain the fix replacing WARN_ON_ONCE with conditional checks. The upstream stable commits are at https://git.kernel.org/stable/c/e9b004ff83067cdf96774b45aea4b239ace99a2f and https://git.kernel.org/stable/c/fd7a982657077469802594a5165bc30b9a55af70 respectively; distributions packaging these stable branches should carry the fix. If immediate upgrade is not feasible and the environment does not use panic_on_warn, operational risk is negligible - the disk continues to function without writeback throttling, which the kernel description explicitly characterizes as harmless. For environments running hardened kernels with panic_on_warn enabled and exposed to unprivileged local users or MTD device operations, prioritize the patch or temporarily restrict ioctl(BLKPG) access via seccomp or capability controls (note: this may affect legitimate partition management tooling).

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39854 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy