CVE-2026-53153
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's list_lru mechanism during memcg reparenting. The xarray entry for a dying memcg is cleared before draining its per-node lists, allowing concurrent list_lru_del() operations to manipulate the same list items under different locks, causing list corruption.
Risk Assessment
The risk is kernel memory corruption due to a race condition, potentially leading to system instability, kernel panic, or privilege escalation.
Recommendation
Immediately update the Linux kernel to a version containing the fix that reverses the order: perform list reparenting first, then clear the xarray entry.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99284Unknown
In the Linux kernel, a vulnerability was resolved in the skb_zerocopy() function of the skbuff networking subsystem. The function does not propagate the shared-frag marker to the destination skb, breaking the invariant relied on by later in-place writers. As a result, an unprivileged user can write into the page cache of a root-owned read-only file.
- CVE-2026-99283Unknown
A bug in the Linux kernel netfilter conntrack TCP timeout selection was found. When an RST packet does not exactly match the expected sequence number, the conntrack entry remains ESTABLISHED, but the short CLOSE timeout (10 seconds) is still applied. A second non-exact RST can lower the timeout before the challenge ACK rate limit expires, allowing the conntrack entry to expire while both TCP endpoints remain established.
- CVE-2026-99282Unknown
In the Linux kernel, net/sched: sch_teql contains a use-after-free vulnerability. teql_master_xmit() incorrectly treats NET_XMIT_DROP as an unconsumed packet and operates on freed memory. The issue affects configurations with VLAN interfaces and pfifo qdisc with limit 0.
- CVE-2026-99281Unknown
A flaw in the Linux kernel tun/tap mechanism allowed processes without CAP_NET_ADMIN to attach to persistent tun devices that had no owner or group set. Anyone able to open /dev/net/tun could attach to such devices and intercept or inject network traffic. The fix now requires CAP_NET_ADMIN to attach to an ownerless, groupless device.
- CVE-2026-99280Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references. Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.
- CVE-2026-99278Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection. The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS