CVE-2026-53288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53288", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.396Z", "datePublished": "2026-06-26T19:40:48.528Z", "dateUpdated": "2026-06-26T19:40:48.528Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-26T19:40:48.528Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1> vtop ffffffed00601000\nVIRTUAL PHYSICAL\nffffffed00601000 83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n PGD: ffffffecffd62da0 => 10000000833fb003\n PMD: ffffff80033fb018 => 10000000833fe003\n PTE: ffffff80033fe008 => 68000083401f03\n PAGE: 83401000\n\n PTE PHYSICAL FLAGS\n68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)\n\n PAGE PHYSICAL MAPPING INDEX CNT FLAGS\nfffffffec00d0040 83401000 0 0 1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kernel-pgtable.h"], "versions": [{"version": "fdd380a5950503a07aaaf74536a0c2f223475eb0", "lessThan": "a4ff33053da0a34b14abb5c96dc5a48379e26fce", "status": "affected", "versionType": "git"}, {"version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "lessThan": "dcb89deed40ba55ff7020061712fdabf098cc2cc", "status": "affected", "versionType": "git"}, {"version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "lessThan": "9fe9e3acaa14921b0cf0d6cc2de5b562499bf721", "status": "affected", "versionType": "git"}, {"version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "lessThan": "4d8e74ad4585672489da6145b3328d415f50db82", "status": "affected", "versionType": "git"}, {"version": "88025faf2aa08c7468d68d8cb31a53b55aae6ee0", "status": "affected", "versionType": "git"}, {"version": "6.12.54", "lessThan": "6.12.91", "status": "affected", "versionType": "semver"}, {"version": "6.17.4", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kernel-pgtable.h"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.54", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"}, {"url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"}, {"url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"}, {"url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"}], "title": "arm64: Reserve an extra page for early kernel mapping", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kernel-pgtable.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4ff33053da0a34b14abb5c96dc5a48379e26fce", "status": "affected", "version": "fdd380a5950503a07aaaf74536a0c2f223475eb0", "versionType": "git"}, {"lessThan": "dcb89deed40ba55ff7020061712fdabf098cc2cc", "status": "affected", "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "versionType": "git"}, {"lessThan": "9fe9e3acaa14921b0cf0d6cc2de5b562499bf721", "status": "affected", "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "versionType": "git"}, {"lessThan": "4d8e74ad4585672489da6145b3328d415f50db82", "status": "affected", "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af", "versionType": "git"}, {"status": "affected", "version": "88025faf2aa08c7468d68d8cb31a53b55aae6ee0", "versionType": "git"}, {"lessThan": "6.12.91", "status": "affected", "version": "6.12.54", "versionType": "semver"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kernel-pgtable.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BECAD95D-655A-4E27-8005-7A599FD0280A", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.12.54", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B2D0531-24AE-45F8-BE6F-5DD45B339658", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.17.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1> vtop ffffffed00601000\nVIRTUAL PHYSICAL\nffffffed00601000 83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n PGD: ffffffecffd62da0 => 10000000833fb003\n PMD: ffffff80033fb018 => 10000000833fe003\n PTE: ffffff80033fe008 => 68000083401f03\n PAGE: 83401000\n\n PTE PHYSICAL FLAGS\n68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)\n\n PAGE PHYSICAL MAPPING INDEX CNT FLAGS\nfffffffec00d0040 83401000 0 0 1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]"}], "id": "CVE-2026-53288", "lastModified": "2026-07-08T03:54:34.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-26T20:17:21.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: arm64: Reserve an extra page for early kernel mapping", "id": "2493724", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493724"}, "csaw": false, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel, affecting systems running on the arm64 architecture. This vulnerability occurs during the early kernel mapping process, where an insufficient number of pages are reserved for kernel segments. This can lead to an overflow of data into adjacent memory pages, potentially impacting system stability or causing unintended memory access within the kernel."], "name": "CVE-2026-53288", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53288\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53288\nhttps://lore.kernel.org/linux-cve-announce/2026062616-CVE-2026-53288-eeaf@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fdd380a5950503a07aaaf74536a0c2f223475eb0,a4ff33053da0a34b14abb5c96dc5a48379e26fce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5973a62efa34c80c9a4e5eac1fca6f6209b902af,dcb89deed40ba55ff7020061712fdabf098cc2cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5973a62efa34c80c9a4e5eac1fca6f6209b902af,9fe9e3acaa14921b0cf0d6cc2de5b562499bf721)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5973a62efa34c80c9a4e5eac1fca6f6209b902af,4d8e74ad4585672489da6145b3328d415f50db82)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "88025faf2aa08c7468d68d8cb31a53b55aae6ee0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.54,6.12.91)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.17.4,6.18)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-26T23:30:05.938616+00:00", "updated": "2026-08-12T08:45:02.330705+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}