CVE-2026-53020

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53020", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.379Z", "datePublished": "2026-06-24T16:29:29.796Z", "dateUpdated": "2026-08-05T12:32:40.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:32:40.781Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential race condition in TLB sync\n\nDuring the TLB sync, we need to traverse and modify the page table,\nso we should hold the page table lock. Since full SMP support for\nthreads within the same process is still missing, let's disable the\nsplit page table lock for simplicity."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable UML TLB synchronization path is reached by local UML guest execution through ordinary memory-management activity such as syscalls, page faults, and returning to userspace. It is not a network, adjacent, or physical input path.\nAC:L - The race is reachable when an attacker can create concurrent UML guest activity on an SMP UML kernel, such as multithreaded mmap/munmap/mprotect/page-fault activity. The attacker can drive both sides of the race and repeat attempts, so no external condition is required.\nPR:L - An unprivileged local user inside the affected UML guest can exercise the relevant memory-management paths. No real root or admin capability is required.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform another action. The attacker can trigger the race directly through local execution.\nS:U - The vulnerable component and primary impacted resources are within the same UML/Linux kernel security authority. This is not a demonstrated KVM/Xen-style guest-to-host escape or IOMMU boundary bypass.\nC:H - The race affects page-table synchronization and can leave stale or incorrect mappings, plausibly exposing memory that should no longer be readable by the attacking process. Under the required uncertainty rule, page-table corruption/stale mapping effects justify high confidentiality impact.\nI:H - The same stale or corrupted page-table/host-mapping state can plausibly allow writes through mappings that should have been removed or write-protected. Because page tables are memory access control structures, the defensible high-impact case is arbitrary or security-critical memory modification.\nA:H - Racing page-table traversal and modification can corrupt or desynchronize mappings enough to crash, panic, or hang the UML kernel. Any kernel crash or fatal availability failure is high impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/um/kernel/tlb.c", "mm/Kconfig"], "versions": [{"version": "1e4ee5135d814fe4785890790cec81c3132888fb", "lessThan": "f21c343ec7419377bff89ab11146c03ae117036f", "status": "affected", "versionType": "git"}, {"version": "1e4ee5135d814fe4785890790cec81c3132888fb", "lessThan": "102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/um/kernel/tlb.c", "mm/Kconfig"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f"}, {"url": "https://git.kernel.org/stable/c/102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3"}], "title": "um: Fix potential race condition in TLB sync", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/um/kernel/tlb.c", "mm/Kconfig"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f21c343ec7419377bff89ab11146c03ae117036f", "status": "affected", "version": "1e4ee5135d814fe4785890790cec81c3132888fb", "versionType": "git"}, {"lessThan": "102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3", "status": "affected", "version": "1e4ee5135d814fe4785890790cec81c3132888fb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/um/kernel/tlb.c", "mm/Kconfig"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential race condition in TLB sync\n\nDuring the TLB sync, we need to traverse and modify the page table,\nso we should hold the page table lock. Since full SMP support for\nthreads within the same process is still missing, let's disable the\nsplit page table lock for simplicity."}], "id": "CVE-2026-53020", "lastModified": "2026-07-15T14:12:13.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-24T17:17:13.317", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: um: Fix potential race condition in TLB sync", "id": "2492426", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492426"}, "csaw": false, "cwe": "CWE-414", "details": ["In the Linux kernel, the following vulnerability has been resolved:\num: Fix potential race condition in TLB sync\nDuring the TLB sync, we need to traverse and modify the page table,\nso we should hold the page table lock. Since full SMP support for\nthreads within the same process is still missing, let's disable the\nsplit page table lock for simplicity.", "A flaw was found in the Linux kernel. A race condition can occur during Translation Lookaside Buffer (TLB) synchronization when the page table is traversed and modified without properly holding the necessary page table lock. This vulnerability may allow for unpredictable system behavior or instability due to concurrent access to shared resources."], "name": "CVE-2026-53020", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53020\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53020\nhttps://lore.kernel.org/linux-cve-announce/2026062452-CVE-2026-53020-6e28@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1e4ee5135d814fe4785890790cec81c3132888fb,f21c343ec7419377bff89ab11146c03ae117036f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1e4ee5135d814fe4785890790cec81c3132888fb,102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T21:00:11.772378+00:00", "updated": "2026-08-12T06:30:17.207687+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}