CVE-2026-53326

MediumCVSS 5.5/10Last modified Jul 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

debugobjects: Don't call fill_pool() in early boot hardirq context

When booting a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage" lockdep warning message was reported to the console.

During early boot, interrupts are enabled before the scheduler is enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard interrupt context handler attempt to fill the pool

This can lead to a deadlock when the interrupt occurred when the interrupt hits a region which holds a lock that is required to be taken in the allocation path.

Add a new can_fill_pool() helper and reorder the exception rule and forbid this scenario by excluding allocations from hard interrupt context.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-667

Affected software

VendorProductVersions
LinuxLinux>= 13abb2b11ac3b6cb89822f152e770081893e4bc3, < 3cc90ea0dd0fb1f8db577dcdc027fc46c06049f6; >= 0d2a64411b0974a469ff56e62441055147e5a194, < 5d95f6b267f3d7fe54f42a3b224bb4a3d3990b41; >= c93859a52b0d6953cdaa17fd7fb46a6871b015cf, < 27335c50014102e9077b784ebd314954286afcab; >= a460935022f512e167b4c5d4c12d85f89ba6aabd, < 44b8b03a9fb5c575548fc72c674653d6baba142a; >= 06e0ae988f6e3499785c407429953ade19c1096b, < 7bc71bdb1c1526c7f02a6adab324394ff1327b0a; >= 06e0ae988f6e3499785c407429953ade19c1096b, < 0d046ae106255cba5eb83b23f78ee93f3620247d
LinuxLinux6.19

References

Timeline

Published
Jul 1, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-533275.5In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fill_pool() if pi_blocked_on On RT enabled kernelCVE-2026-533285.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task(CVE-2026-533297.0In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & HCVE-2026-53339.8A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file CVE-2026-533307.1In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() CVE-2026-533315.5In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock During the SSCVE-2026-533325.5In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd WhenCVE-2026-533335.5In the Linux kernel, the following vulnerability has been resolved: mm/mincore: handle non-swap entries before !CONFIG_SWAP guard mincore_CVE-2026-533345.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damonCVE-2026-533355.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocaCVE-2026-533365.5In the Linux kernel, the following vulnerability has been resolved: nvmem: layouts: onie-tlv: fix hang on unknown types The EEPROM on my bCVE-2026-533375.5In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_
CVE-2026-53326: Medium severity, CVSS 5.5 | Vulnix