Skip to main content

Linux Kernel EUVDEUVD-2026-48913

| CVE-2026-64369 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-25 Linux GHSA-ww8w-mgxm-5cf5
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to invoke the vulnerable code path; impact is availability-only (infinite loop/hang); no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 08, 2026 - 17:27 vuln.today
CVSS changed
Sep 08, 2026 - 15:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

s390: Revert support for DCACHE_WORD_ACCESS

load_unaligned_zeropad() reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an exception.

For pages which are donated to the Ultravisor for secure execution purposes the do_secure_storage_access() exception handler however does not handle such exceptions correctly. Such an exception may result in an endless exception loop which will never be resolved.

An attempt to fix this [1] turned out to be not sufficient. For now revert load_unaligned_zeropad() until this problem has been resolved in a proper way.

Note that the implementation of load_unaligned_zeropad() itself is correct. The revert is just a temporary workaround until there is complete fix for secure storage access exceptions.

[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")

AnalysisAI

Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.

Technical ContextAI

The vulnerability arises from the interaction between load_unaligned_zeropad() - a kernel optimization that reads eight unaligned bytes and handles resulting page faults through an exception fixup table - and the IBM Secure Execution (Ultravisor) memory model on s390/IBM Z hardware. In Secure Execution, guest pages can be donated to the Ultravisor, rendering them inaccessible to the normal kernel exception path. When load_unaligned_zeropad() spans a page boundary where the second page is such a donated page, a secure storage access exception is raised. The do_secure_storage_access() handler was not written to handle this cross-page fixup path, producing a CWE-835 condition (Loop with Unreachable Exit Condition). CPE cpe:2.3:a:linux:linux:* identifies the upstream Linux kernel; the regression was introduced at kernel 6.7 when DCACHE_WORD_ACCESS support was added for s390, and a prior partial fix (commit b00be77302d7) proved insufficient. The revert of load_unaligned_zeropad() on s390 is explicitly described as a temporary workaround pending a proper resolution.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.12.97, 7.1.4, or 7.2-rc1 for upstream users; stable-branch commits are available at https://git.kernel.org/stable/c/c9e0f1517631ac08987f8385817119bccf2f1f12, https://git.kernel.org/stable/c/be79d285bea70d0edd5015bd487311bfa8cbebc9, https://git.kernel.org/stable/c/c94806905e02cc8e17a69c822d93c41743b7ffc5, and https://git.kernel.org/stable/c/37540b8c287fc817bdbd0c62bb75ad6eab0e5d03. Ubuntu users should apply the updates from USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). As an interim compensating control for systems that cannot be patched immediately, disabling IBM Secure Execution removes the triggering condition (donated pages are never created), but this eliminates the memory isolation guarantees Secure Execution provides - a significant security trade-off in multi-tenant or confidential-computing environments. The upstream fix is explicitly a temporary revert; a permanent resolution to secure storage access exception handling is pending.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-48913 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy