Look up another CVE · open CVE-2026-53020 in the interactive tracker
CVE-2026-53020
um: Fix potential race condition in TLB sync
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem arch/um. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53020 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/um/kernel/tlb.c
mm/Kconfig
- What this is
- USER-MODE LINUX (UML)MAINTAINERS section matched on arch/um/ · linux-um@lists.infradead.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/um
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.19 | 7.0.10 | f21c343ec741 |
| 6.19 | 7.1 | 102331b66bca |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable UML TLB synchronization path is reached by local UML guest execution through ordinary memory-management activity such as syscalls, page faults, and returning to userspace. It is not a network, adjacent, or physical input path.
- AC:LAttack complexity, low
- The race is reachable when an attacker can create concurrent UML guest activity on an SMP UML kernel, such as multithreaded mmap/munmap/mprotect/page-fault activity. The attacker can drive both sides of the race and repeat attempts, so no external condition is required.
- PR:LPrivileges required, low
- An unprivileged local user inside the affected UML guest can exercise the relevant memory-management paths. No real root or admin capability is required.
- UI:NUser interaction, none
- Exploitation does not require a victim user to open a file, mount anything, or perform another action. The attacker can trigger the race directly through local execution.
- S:UScope, unchanged
- The vulnerable component and primary impacted resources are within the same UML/Linux kernel security authority. This is not a demonstrated KVM/Xen-style guest-to-host escape or IOMMU boundary bypass.
- C:HConfidentiality impact, high
- The race affects page-table synchronization and can leave stale or incorrect mappings, plausibly exposing memory that should no longer be readable by the attacking process. Under the required uncertainty rule, page-table corruption/stale mapping effects justify high confidentiality impact.
- I:HIntegrity impact, high
- The same stale or corrupted page-table/host-mapping state can plausibly allow writes through mappings that should have been removed or write-protected. Because page tables are memory access control structures, the defensible high-impact case is arbitrary or security-critical memory modification.
- A:HAvailability impact, high
- Racing page-table traversal and modification can corrupt or desynchronize mappings enough to crash, panic, or hang the UML kernel. Any kernel crash or fatal availability failure is high impact.