GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53288 (GCVE-0-2026-53288)

Vulnerability from cvelistv5 – Published: 2026-06-26 19:40 – Updated: 2026-06-26 19:40
VLAI
Title
arm64: Reserve an extra page for early kernel mapping
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: Reserve an extra page for early kernel mapping The final part of [data, end) segment may overflow into the next page of init_pg_end[1] which is the gap page before early_init_stack[2]: [1] crash_arm64_v9.0.1> vtop ffffffed00601000 VIRTUAL PHYSICAL ffffffed00601000 83401000 PAGE DIRECTORY: ffffffecffd62000 PGD: ffffffecffd62da0 => 10000000833fb003 PMD: ffffff80033fb018 => 10000000833fe003 PTE: ffffff80033fe008 => 68000083401f03 PAGE: 83401000 PTE PHYSICAL FLAGS 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN) PAGE PHYSICAL MAPPING INDEX CNT FLAGS fffffffec00d0040 83401000 0 0 1 4000 reserved [2] ffffffed002c8000 (r) __pi__data ffffffed0054e000 (d) __pi___bss_start ffffffed005f5000 (b) __pi_init_pg_dir ffffffed005fe000 (b) __pi_init_pg_end ffffffed005ff000 (B) early_init_stack ffffffed00608000 (b) __pi__end For 4K pages, the early kernel mapping may use 2MB block entries but the kernel segments are only 64KB aligned. Segment boundaries that fall within a 2MB block therefore require a PTE table so that different attributes can be applied on either side of the boundary. KERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel VMAs registered by declare_kernel_vmas(). However, since commit 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only"), the early mapper also maps [_text, _stext) separately from [_stext, _etext). This adds one more early-only split and can require one more page-table page than the existing EARLY_SEGMENT_EXTRA_PAGES allowance reserves. Increase the 4K-page early mapping allowance by one page to cover that additional split. [catalin.marinas@arm.com: rewrote part of the commit log] [catalin.marinas@arm.com: expanded the code comment]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdd380a5950503a07aaaf74536a0c2f223475eb0 , < a4ff33053da0a34b14abb5c96dc5a48379e26fce (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < dcb89deed40ba55ff7020061712fdabf098cc2cc (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < 9fe9e3acaa14921b0cf0d6cc2de5b562499bf721 (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < 4d8e74ad4585672489da6145b3328d415f50db82 (git)
Affected: 88025faf2aa08c7468d68d8cb31a53b55aae6ee0 (git)
Affected: 6.12.54 , < 6.12.91 (semver)
Affected: 6.17.4 , < 6.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kernel-pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a4ff33053da0a34b14abb5c96dc5a48379e26fce",
              "status": "affected",
              "version": "fdd380a5950503a07aaaf74536a0c2f223475eb0",
              "versionType": "git"
            },
            {
              "lessThan": "dcb89deed40ba55ff7020061712fdabf098cc2cc",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "lessThan": "9fe9e3acaa14921b0cf0d6cc2de5b562499bf721",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "lessThan": "4d8e74ad4585672489da6145b3328d415f50db82",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "88025faf2aa08c7468d68d8cb31a53b55aae6ee0",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.91",
              "status": "affected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kernel-pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.12.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\nVIRTUAL           PHYSICAL\nffffffed00601000  83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n   PGD: ffffffecffd62da0 =\u003e 10000000833fb003\n   PMD: ffffff80033fb018 =\u003e 10000000833fe003\n   PTE: ffffff80033fe008 =\u003e 68000083401f03\n  PAGE: 83401000\n\n     PTE        PHYSICAL  FLAGS\n68000083401f03  83401000  (VALID|SHARED|AF|NG|PXN|UXN)\n\n      PAGE       PHYSICAL      MAPPING       INDEX CNT FLAGS\nfffffffec00d0040 83401000                0        0  1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T19:40:48.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"
        }
      ],
      "title": "arm64: Reserve an extra page for early kernel mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53288",
    "datePublished": "2026-06-26T19:40:48.528Z",
    "dateReserved": "2026-06-09T07:44:35.396Z",
    "dateUpdated": "2026-06-26T19:40:48.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53288",
      "date": "2026-09-16",
      "epss": "0.00122",
      "percentile": "0.02277"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53288\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-26T20:17:21.600\",\"lastModified\":\"2026-07-08T03:54:34.127\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: Reserve an extra page for early kernel mapping\\n\\nThe final part of [data, end) segment may overflow into the next page of\\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\\n\\n[1]\\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\\nVIRTUAL           PHYSICAL\\nffffffed00601000  83401000\\n\\nPAGE DIRECTORY: ffffffecffd62000\\n   PGD: ffffffecffd62da0 =\u003e 10000000833fb003\\n   PMD: ffffff80033fb018 =\u003e 10000000833fe003\\n   PTE: ffffff80033fe008 =\u003e 68000083401f03\\n  PAGE: 83401000\\n\\n     PTE        PHYSICAL  FLAGS\\n68000083401f03  83401000  (VALID|SHARED|AF|NG|PXN|UXN)\\n\\n      PAGE       PHYSICAL      MAPPING       INDEX CNT FLAGS\\nfffffffec00d0040 83401000                0        0  1 4000 reserved\\n\\n[2]\\nffffffed002c8000 (r) __pi__data\\nffffffed0054e000 (d) __pi___bss_start\\nffffffed005f5000 (b) __pi_init_pg_dir\\nffffffed005fe000 (b) __pi_init_pg_end\\nffffffed005ff000 (B) early_init_stack\\nffffffed00608000 (b) __pi__end\\n\\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\\nkernel segments are only 64KB aligned. Segment boundaries that fall\\nwithin a 2MB block therefore require a PTE table so that different\\nattributes can be applied on either side of the boundary.\\n\\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\\nVMAs registered by declare_kernel_vmas(). However, since commit\\n5973a62efa34 (\\\"arm64: map [_text, _stext) virtual address range\\nnon-executable+read-only\\\"), the early mapper also maps [_text, _stext)\\nseparately from [_stext, _etext). This adds one more early-only split\\nand can require one more page-table page than the existing\\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\\n\\nIncrease the 4K-page early mapping allowance by one page to cover that\\nadditional split.\\n\\n[catalin.marinas@arm.com: rewrote part of the commit log]\\n[catalin.marinas@arm.com: expanded the code comment]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/include/asm/kernel-pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fdd380a5950503a07aaaf74536a0c2f223475eb0\",\"lessThan\":\"a4ff33053da0a34b14abb5c96dc5a48379e26fce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"dcb89deed40ba55ff7020061712fdabf098cc2cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"9fe9e3acaa14921b0cf0d6cc2de5b562499bf721\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"4d8e74ad4585672489da6145b3328d415f50db82\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88025faf2aa08c7468d68d8cb31a53b55aae6ee0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.54\",\"lessThan\":\"6.12.91\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.17.4\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/include/asm/kernel-pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.54\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"BECAD95D-655A-4E27-8005-7A599FD0280A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.17.4\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"3B2D0531-24AE-45F8-BE6F-5DD45B339658\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-29T09:58:43+00:00",
      "cve": "CVE-2026-53288",
      "id": "CVE-2026-53288",
      "initial_release_date": "2026-06-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: Reserve an extra page for early kernel mapping",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53288.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-01T03:16:27Z",
      "cve": "CVE-2026-53288",
      "id": "CVE-2026-53288",
      "initial_release_date": "2026-06-28T01:09:18Z",
      "product_status:known_not_affected": "291",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53288",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53288.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.