{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s memory cgroup (memcg) list_lru component. A race condition occurs during the reparenting of list_lru entries when an xarray entry is cleared before its associated lists are fully reparented. This allows concurrent operations to modify list pointers under different locks, leading to memory corruption. This corruption can result in system instability or a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-820",
                "description": "Missing Synchronization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T12:04:29.912Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53153"
          },
          {
            "name": "RHBZ#2492790",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492790"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53153.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: mm/list_lru: drain before clearing xarray entry on reparent",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c19ff4351214f059349788e13e70e74325831ff6",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            },
            {
              "lessThan": "2b66496d794e98f7aeec7688573051f22ec40bac",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            },
            {
              "lessThan": "98733f3f0becb1ae0701d021c1748e974e5fa55c",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/list_lru: drain before clearing xarray entry on reparent\n\nmemcg_reparent_list_lrus() clears the dying memcg\u0027s xarray entry with\nxas_store(\u0026xas, NULL) before reparenting its per-node lists into the\nparent.  This opens a window where a concurrent list_lru_del() arriving\nfor the dying memcg sees xa_load() == NULL, walks to the parent in\nlock_list_lru_of_memcg(), takes the parent\u0027s per-node lock, and calls\nlist_del_init() on an item still physically linked on the dying memcg\u0027s\nlist.\n\nIf another in-flight thread holds the dying memcg\u0027s per-node lock at the\nsame moment (another list_lru_del, or a list_lru_walk_one running an\nisolate callback), both threads modify -\u003enext/-\u003eprev pointers on the same\nphysical list under different locks.  Adjacent items can corrupt each\nother\u0027s links.\n\nFix it by reversing the order: reparent each per-node list and mark the\nchild\u0027s list lru dead and then clear the xarray entry.  Any concurrent\nlist_lru op that finds the still-set xarray entry either takes the dying\nmemcg\u0027s per-node lock (synchronizing with the drain) or sees LONG_MIN and\nwalks to the parent, where the items now live."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local cgroup filesystem operations, primarily mkdir/rmdir and process placement in a memory cgroup, combined with local filesystem or memory-pressure activity that manipulates memcg-aware list_lru entries. It is not directly reachable by unauthenticated network packets.\nAC:L - The issue is a race, but a local attacker with control of a delegated cgroup subtree can drive both sides by repeatedly offlining cgroups while concurrently creating/removing dentries, inodes, zswap entries, or triggering shrinker activity. The race is retryable and under attacker influence, so complexity is low.\nPR:L - Creating/removing the affected cgroups requires write access to a cgroup subtree, but Linux explicitly supports delegation of cgroup subtrees to less-privileged users and cgroup namespaces. No init-namespace root-only capability is inherent once such a subtree is delegated.\nUI:N - No victim user action is needed after the attacker has local access to the relevant cgroup subtree. The attacker can trigger cgroup teardown and concurrent LRU activity directly.\nS:U - The corruption occurs within the kernel memory-management and cgroup/list_lru scope and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or separate security scope crossing.\nC:H - The bug corrupts kernel list_head next/prev pointers in memcg-aware LRUs such as dentries, inodes, zswap, and workingset shadow nodes. Such kernel memory corruption can plausibly be shaped into disclosure primitives, and uncertainty is scored at the higher severity.\nI:H - Concurrent list operations under different locks can corrupt adjacent kernel object links and later list manipulation can write through attacker-influenced pointers. This is a kernel memory corruption primitive with plausible control-flow or arbitrary-write exploitation potential.\nA:H - Even without full exploitation, corrupted kernel list links can trigger list debugging splats, oopses, panics, hangs, or reclaim/list traversal failures. Kernel crash availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:32.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c19ff4351214f059349788e13e70e74325831ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b66496d794e98f7aeec7688573051f22ec40bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/98733f3f0becb1ae0701d021c1748e974e5fa55c"
        }
      ],
      "title": "mm/list_lru: drain before clearing xarray entry on reparent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53153",
    "datePublished": "2026-06-25T08:38:37.521Z",
    "dateReserved": "2026-06-09T07:44:35.388Z",
    "dateUpdated": "2026-09-02T12:04:29.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}