CVE-2026-53277

HighCVSS 8.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation

walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking kvm->srcu.

Fix by acquiring kvm->srcu prior to the table walk in both instances.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-662CWE-820

Affected software

VendorProductVersions
LinuxLinux>= be04cebf3e78874627dc1042991d5d504464a5cc, < 0648b375aa951cc15d9e90f9ac4de71e0b51fa45; >= be04cebf3e78874627dc1042991d5d504464a5cc, < 97706097f9b851cfe55c3b00b083dfc2bcf542bc; >= be04cebf3e78874627dc1042991d5d504464a5cc, < ec42b4ed1b072ea2d03f086061aa67bad6d8de39; >= be04cebf3e78874627dc1042991d5d504464a5cc, < f2ca45b50d4216c9cc7ffabf50d9ad1932209251
LinuxLinux6.12
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 21, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-532785.5In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Check whether the config array is allocated before destroyingCVE-2026-532795.5In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktrail_lvds: fix hang on init failure The LVDS init code CVE-2026-53286.3A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the functiCVE-2026-532805.5In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()CVE-2026-532818.8In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption CommCVE-2026-532825.5In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Push kjump return address even for non-kjump kexec The versCVE-2026-532835.5In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bounds-check devid in __rlookup_amd_iommu() iommu_device_reCVE-2026-532847.5In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes [WCVE-2026-532855.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PRECVE-2026-532867.8In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-after-free in aux device error paths WheCVE-2026-532875.5In the Linux kernel, the following vulnerability has been resolved: audit: fix incorrect inheritable capability in CAPSET records __audit_CVE-2026-532885.5In the Linux kernel, the following vulnerability has been resolved: arm64: Reserve an extra page for early kernel mapping The final part o