CVE-2026-53020 (GCVE-0-2026-53020)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-05 12:32
VLAI
Title
um: Fix potential race condition in TLB sync
Summary
In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e4ee5135d814fe4785890790cec81c3132888fb , < f21c343ec7419377bff89ab11146c03ae117036f (git)
Affected: 1e4ee5135d814fe4785890790cec81c3132888fb , < 102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/um/kernel/tlb.c",
            "mm/Kconfig"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f21c343ec7419377bff89ab11146c03ae117036f",
              "status": "affected",
              "version": "1e4ee5135d814fe4785890790cec81c3132888fb",
              "versionType": "git"
            },
            {
              "lessThan": "102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3",
              "status": "affected",
              "version": "1e4ee5135d814fe4785890790cec81c3132888fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/um/kernel/tlb.c",
            "mm/Kconfig"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential race condition in TLB sync\n\nDuring the TLB sync, we need to traverse and modify the page table,\nso we should hold the page table lock. Since full SMP support for\nthreads within the same process is still missing, let\u0027s disable the\nsplit page table lock for simplicity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable UML TLB synchronization path is reached by local UML guest execution through ordinary memory-management activity such as syscalls, page faults, and returning to userspace. It is not a network, adjacent, or physical input path.\nAC:L - The race is reachable when an attacker can create concurrent UML guest activity on an SMP UML kernel, such as multithreaded mmap/munmap/mprotect/page-fault activity. The attacker can drive both sides of the race and repeat attempts, so no external condition is required.\nPR:L - An unprivileged local user inside the affected UML guest can exercise the relevant memory-management paths. No real root or admin capability is required.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform another action. The attacker can trigger the race directly through local execution.\nS:U - The vulnerable component and primary impacted resources are within the same UML/Linux kernel security authority. This is not a demonstrated KVM/Xen-style guest-to-host escape or IOMMU boundary bypass.\nC:H - The race affects page-table synchronization and can leave stale or incorrect mappings, plausibly exposing memory that should no longer be readable by the attacking process. Under the required uncertainty rule, page-table corruption/stale mapping effects justify high confidentiality impact.\nI:H - The same stale or corrupted page-table/host-mapping state can plausibly allow writes through mappings that should have been removed or write-protected. Because page tables are memory access control structures, the defensible high-impact case is arbitrary or security-critical memory modification.\nA:H - Racing page-table traversal and modification can corrupt or desynchronize mappings enough to crash, panic, or hang the UML kernel. Any kernel crash or fatal availability failure is high impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:40.781Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f"
        },
        {
          "url": "https://git.kernel.org/stable/c/102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3"
        }
      ],
      "title": "um: Fix potential race condition in TLB sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53020",
    "datePublished": "2026-06-24T16:29:29.796Z",
    "dateReserved": "2026-06-09T07:44:35.379Z",
    "dateUpdated": "2026-08-05T12:32:40.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53020",
      "date": "2026-08-16",
      "epss": "0.00093",
      "percentile": "0.00646"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53020\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:13.317\",\"lastModified\":\"2026-07-15T14:12:13.387\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\num: Fix potential race condition in TLB sync\\n\\nDuring the TLB sync, we need to traverse and modify the page table,\\nso we should hold the page table lock. Since full SMP support for\\nthreads within the same process is still missing, let\u0027s disable the\\nsplit page table lock for simplicity.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/um/kernel/tlb.c\",\"mm/Kconfig\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e4ee5135d814fe4785890790cec81c3132888fb\",\"lessThan\":\"f21c343ec7419377bff89ab11146c03ae117036f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e4ee5135d814fe4785890790cec81c3132888fb\",\"lessThan\":\"102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/um/kernel/tlb.c\",\"mm/Kconfig\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-26T12:00:32+00:00",
      "cve": "CVE-2026-53020",
      "id": "CVE-2026-53020",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: um: Fix potential race condition in TLB sync",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53020.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.