Skip to main content

Linux Kernel EUVDEUVD-2026-40980

| CVE-2026-53346 HIGH
Out-of-bounds Read (CWE-125)
2026-07-01 Linux GHSA-mp8j-7v82-r69x
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
4.1 MEDIUM

Config-only boot crash requiring control of the kernel build (PR:H) and a narrow feature combination (AC:H); availability-only (A:H), no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:39 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
7.1 (HIGH)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES

Due to a rustc bug [1] the -Cforce-unwind-tables=y flag only emits the uwtable annotation for functions, but not for the module. This means that compiler-generated functions such as 'asan.module_ctor' do not receive the uwtable annotation.

When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures because the dwarf information emitted for the kasan constructors is wrong, which causes the SCS boot patching code to patch the constructor in an illegal manner. Specifically, the paciasp instruction is patched, but the autiasp instruction is not. This mismatch leads to a crash when the constructor is called during boot.

============== BUG: KASAN: global-out-of-bounds in do_basic_setup+0x4c/0x90 Read of size 8 at addr ffffffe3cc7eb488 by task swapper/0/1

Specifically the faulting instruction is the (*fn)() to invoke the constructor in do_ctors() of the init/main.c file.

Once the fix lands in rustc, this flag can be made conditional on the rustc version. Note that passing the flag on a rustc with the fix present has no effect.

[ The fix [1] has landed for Rust 1.98.0 (expected release on 2026-08-20).

Thus add a version check as discussed.

  • Miguel ]

[ Adjusted link and comment. - Miguel ]

AnalysisAI

Boot-time denial of service affects Rust-enabled Linux kernels on arm64 when both CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS are set and the kernel is built with rustc older than 1.98.0. A rustc bug omits the module-level uwtable annotation, so compiler-generated constructors (e.g. KASAN's asan.module_ctor) carry incorrect DWARF unwind data; the shadow-call-stack (SCS) boot patcher then rewrites the paciasp but not the matching autiasp instruction, corrupting the constructor and triggering a KASAN global-out-of-bounds fault and kernel panic during do_ctors() at boot. This is a self-inflicted toolchain/config interaction rather than an attacker-driven flaw - no public exploit identified at time of analysis, not in CISA KEV, and EPSS is only 0.16% (5th percentile).

Technical ContextAI

The bug lives at the intersection of the kernel's Rust build path, arm64 pointer authentication (PAC), and the Shadow Call Stack (SCS) hardening feature. CONFIG_UNWIND_PATCH_PAC_INTO_SCS uses DWARF unwind tables to locate PAC prologue/epilogue instructions (paciasp/autiasp) and rewrite them into SCS push/pop operations at boot. Rust is compiled with -Cforce-unwind-tables=y, but a rustc defect (fixed in Rust 1.98.0, expected 2026-08-20) emits the uwtable attribute per-function only, never on the module, so synthetic functions like the KASAN sanitizer constructor asan.module_ctor lack unwind metadata. With wrong DWARF, the SCS patcher patches paciasp but leaves autiasp intact, producing a mismatched, illegally patched constructor. CWE-125 (out-of-bounds read) is how the failure surfaces - KASAN reports a global-out-of-bounds read in do_basic_setup/do_ctors when the mispatched constructor is invoked. CPE data points to the generic linux:linux application entries and does not distinguish the arm64/Rust/KASAN configuration that is actually required.

RemediationAI

Vendor-released patch: upgrade to Linux stable 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later), which add the arm64 Rust uwtable module flag under a rustc-version check; the referenced fixes are the git.kernel.org stable commits (bde772ee…, d0f25a17…, 7de13410…, ac35b558…). Because the flag is version-gated, once you build with rustc 1.98.0 or newer (expected 2026-08-20) the underlying defect is absent and passing the flag is a no-op, so upgrading the Rust toolchain is an equally valid fix. If you cannot patch immediately, effective compensating controls are build-time: disable CONFIG_UNWIND_PATCH_PAC_INTO_SCS (removes the faulty SCS boot-patching path, at the cost of that specific PAC-into-SCS hardening on arm64), or disable Rust support / KASAN in the kernel build (removes the sanitizer constructors that trigger the mispatch, at the cost of Rust drivers and KASAN coverage respectively). These trade-offs only matter for arm64 hardened builds; x86 and non-Rust kernels are unaffected. Advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-53346.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-40980 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy