GHSA-24WQ-6X4V-Q3FV
Vulnerability from github – Published: 2026-06-26 21:32 – Updated: 2026-07-08 06:31In the Linux kernel, the following vulnerability has been resolved:
arm64: Reserve an extra page for early kernel mapping
The final part of [data, end) segment may overflow into the next page of init_pg_end[1] which is the gap page before early_init_stack[2]:
[1] crash_arm64_v9.0.1> vtop ffffffed00601000 VIRTUAL PHYSICAL ffffffed00601000 83401000
PAGE DIRECTORY: ffffffecffd62000 PGD: ffffffecffd62da0 => 10000000833fb003 PMD: ffffff80033fb018 => 10000000833fe003 PTE: ffffff80033fe008 => 68000083401f03 PAGE: 83401000
PTE PHYSICAL FLAGS
68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
fffffffec00d0040 83401000 0 0 1 4000 reserved
[2] ffffffed002c8000 (r) __pi__data ffffffed0054e000 (d) __pibssstart ffffffed005f5000 (b) pi_init_pg_dir ffffffed005fe000 (b) __pi_init_pg_end ffffffed005ff000 (B) early_init_stack ffffffed00608000 (b) __pi__end
For 4K pages, the early kernel mapping may use 2MB block entries but the kernel segments are only 64KB aligned. Segment boundaries that fall within a 2MB block therefore require a PTE table so that different attributes can be applied on either side of the boundary.
KERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel VMAs registered by declare_kernel_vmas(). However, since commit 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only"), the early mapper also maps [_text, _stext) separately from [_stext, _etext). This adds one more early-only split and can require one more page-table page than the existing EARLY_SEGMENT_EXTRA_PAGES allowance reserves.
Increase the 4K-page early mapping allowance by one page to cover that additional split.
[catalin.marinas@arm.com: rewrote part of the commit log] [catalin.marinas@arm.com: expanded the code comment]
{
"affected": [],
"aliases": [
"CVE-2026-53288"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T20:17:21Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\nVIRTUAL PHYSICAL\nffffffed00601000 83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n PGD: ffffffecffd62da0 =\u003e 10000000833fb003\n PMD: ffffff80033fb018 =\u003e 10000000833fe003\n PTE: ffffff80033fe008 =\u003e 68000083401f03\n PAGE: 83401000\n\n PTE PHYSICAL FLAGS\n68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)\n\n PAGE PHYSICAL MAPPING INDEX CNT FLAGS\nfffffffec00d0040 83401000 0 0 1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]",
"id": "GHSA-24wq-6x4v-q3fv",
"modified": "2026-07-08T06:31:35Z",
"published": "2026-06-26T21:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53288"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.