CVE-2026-53020 (GCVE-0-2026-53020)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1e4ee5135d814fe4785890790cec81c3132888fb
Version: 1e4ee5135d814fe4785890790cec81c3132888fb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/um/kernel/tlb.c",
            "mm/Kconfig"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f21c343ec7419377bff89ab11146c03ae117036f",
              "status": "affected",
              "version": "1e4ee5135d814fe4785890790cec81c3132888fb",
              "versionType": "git"
            },
            {
              "lessThan": "102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3",
              "status": "affected",
              "version": "1e4ee5135d814fe4785890790cec81c3132888fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/um/kernel/tlb.c",
            "mm/Kconfig"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential race condition in TLB sync\n\nDuring the TLB sync, we need to traverse and modify the page table,\nso we should hold the page table lock. Since full SMP support for\nthreads within the same process is still missing, let\u0027s disable the\nsplit page table lock for simplicity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable UML TLB synchronization path is reached by local UML guest execution through ordinary memory-management activity such as syscalls, page faults, and returning to userspace. It is not a network, adjacent, or physical input path.\nAC:L - The race is reachable when an attacker can create concurrent UML guest activity on an SMP UML kernel, such as multithreaded mmap/munmap/mprotect/page-fault activity. The attacker can drive both sides of the race and repeat attempts, so no external condition is required.\nPR:L - An unprivileged local user inside the affected UML guest can exercise the relevant memory-management paths. No real root or admin capability is required.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform another action. The attacker can trigger the race directly through local execution.\nS:U - The vulnerable component and primary impacted resources are within the same UML/Linux kernel security authority. This is not a demonstrated KVM/Xen-style guest-to-host escape or IOMMU boundary bypass.\nC:H - The race affects page-table synchronization and can leave stale or incorrect mappings, plausibly exposing memory that should no longer be readable by the attacking process. Under the required uncertainty rule, page-table corruption/stale mapping effects justify high confidentiality impact.\nI:H - The same stale or corrupted page-table/host-mapping state can plausibly allow writes through mappings that should have been removed or write-protected. Because page tables are memory access control structures, the defensible high-impact case is arbitrary or security-critical memory modification.\nA:H - Racing page-table traversal and modification can corrupt or desynchronize mappings enough to crash, panic, or hang the UML kernel. Any kernel crash or fatal availability failure is high impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:40.781Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f21c343ec7419377bff89ab11146c03ae117036f"
        },
        {
          "url": "https://git.kernel.org/stable/c/102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3"
        }
      ],
      "title": "um: Fix potential race condition in TLB sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53020",
    "datePublished": "2026-06-24T16:29:29.796Z",
    "dateReserved": "2026-06-09T07:44:35.379Z",
    "dateUpdated": "2026-08-05T12:32:40.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.