CVE-2026-53288 (GCVE-0-2026-53288)

Vulnerability from cvelistv5 – Published: 2026-06-26 19:40 – Updated: 2026-06-26 19:40
VLAI
Title
arm64: Reserve an extra page for early kernel mapping
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: Reserve an extra page for early kernel mapping The final part of [data, end) segment may overflow into the next page of init_pg_end[1] which is the gap page before early_init_stack[2]: [1] crash_arm64_v9.0.1> vtop ffffffed00601000 VIRTUAL PHYSICAL ffffffed00601000 83401000 PAGE DIRECTORY: ffffffecffd62000 PGD: ffffffecffd62da0 => 10000000833fb003 PMD: ffffff80033fb018 => 10000000833fe003 PTE: ffffff80033fe008 => 68000083401f03 PAGE: 83401000 PTE PHYSICAL FLAGS 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN) PAGE PHYSICAL MAPPING INDEX CNT FLAGS fffffffec00d0040 83401000 0 0 1 4000 reserved [2] ffffffed002c8000 (r) __pi__data ffffffed0054e000 (d) __pi___bss_start ffffffed005f5000 (b) __pi_init_pg_dir ffffffed005fe000 (b) __pi_init_pg_end ffffffed005ff000 (B) early_init_stack ffffffed00608000 (b) __pi__end For 4K pages, the early kernel mapping may use 2MB block entries but the kernel segments are only 64KB aligned. Segment boundaries that fall within a 2MB block therefore require a PTE table so that different attributes can be applied on either side of the boundary. KERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel VMAs registered by declare_kernel_vmas(). However, since commit 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only"), the early mapper also maps [_text, _stext) separately from [_stext, _etext). This adds one more early-only split and can require one more page-table page than the existing EARLY_SEGMENT_EXTRA_PAGES allowance reserves. Increase the 4K-page early mapping allowance by one page to cover that additional split. [catalin.marinas@arm.com: rewrote part of the commit log] [catalin.marinas@arm.com: expanded the code comment]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fdd380a5950503a07aaaf74536a0c2f223475eb0 , < a4ff33053da0a34b14abb5c96dc5a48379e26fce (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < dcb89deed40ba55ff7020061712fdabf098cc2cc (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < 9fe9e3acaa14921b0cf0d6cc2de5b562499bf721 (git)
Affected: 5973a62efa34c80c9a4e5eac1fca6f6209b902af , < 4d8e74ad4585672489da6145b3328d415f50db82 (git)
Affected: 88025faf2aa08c7468d68d8cb31a53b55aae6ee0 (git)
Affected: 6.12.54 , < 6.12.91 (semver)
Affected: 6.17.4 , < 6.18 (semver)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kernel-pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a4ff33053da0a34b14abb5c96dc5a48379e26fce",
              "status": "affected",
              "version": "fdd380a5950503a07aaaf74536a0c2f223475eb0",
              "versionType": "git"
            },
            {
              "lessThan": "dcb89deed40ba55ff7020061712fdabf098cc2cc",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "lessThan": "9fe9e3acaa14921b0cf0d6cc2de5b562499bf721",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "lessThan": "4d8e74ad4585672489da6145b3328d415f50db82",
              "status": "affected",
              "version": "5973a62efa34c80c9a4e5eac1fca6f6209b902af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "88025faf2aa08c7468d68d8cb31a53b55aae6ee0",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.91",
              "status": "affected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kernel-pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.12.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\nVIRTUAL           PHYSICAL\nffffffed00601000  83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n   PGD: ffffffecffd62da0 =\u003e 10000000833fb003\n   PMD: ffffff80033fb018 =\u003e 10000000833fe003\n   PTE: ffffff80033fe008 =\u003e 68000083401f03\n  PAGE: 83401000\n\n     PTE        PHYSICAL  FLAGS\n68000083401f03  83401000  (VALID|SHARED|AF|NG|PXN|UXN)\n\n      PAGE       PHYSICAL      MAPPING       INDEX CNT FLAGS\nfffffffec00d0040 83401000                0        0  1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T19:40:48.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"
        }
      ],
      "title": "arm64: Reserve an extra page for early kernel mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53288",
    "datePublished": "2026-06-26T19:40:48.528Z",
    "dateReserved": "2026-06-09T07:44:35.396Z",
    "dateUpdated": "2026-06-26T19:40:48.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53288",
      "date": "2026-07-16",
      "epss": "0.00122",
      "percentile": "0.02315"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53288\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-26T20:17:21.600\",\"lastModified\":\"2026-07-08T03:54:34.127\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: Reserve an extra page for early kernel mapping\\n\\nThe final part of [data, end) segment may overflow into the next page of\\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\\n\\n[1]\\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\\nVIRTUAL           PHYSICAL\\nffffffed00601000  83401000\\n\\nPAGE DIRECTORY: ffffffecffd62000\\n   PGD: ffffffecffd62da0 =\u003e 10000000833fb003\\n   PMD: ffffff80033fb018 =\u003e 10000000833fe003\\n   PTE: ffffff80033fe008 =\u003e 68000083401f03\\n  PAGE: 83401000\\n\\n     PTE        PHYSICAL  FLAGS\\n68000083401f03  83401000  (VALID|SHARED|AF|NG|PXN|UXN)\\n\\n      PAGE       PHYSICAL      MAPPING       INDEX CNT FLAGS\\nfffffffec00d0040 83401000                0        0  1 4000 reserved\\n\\n[2]\\nffffffed002c8000 (r) __pi__data\\nffffffed0054e000 (d) __pi___bss_start\\nffffffed005f5000 (b) __pi_init_pg_dir\\nffffffed005fe000 (b) __pi_init_pg_end\\nffffffed005ff000 (B) early_init_stack\\nffffffed00608000 (b) __pi__end\\n\\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\\nkernel segments are only 64KB aligned. Segment boundaries that fall\\nwithin a 2MB block therefore require a PTE table so that different\\nattributes can be applied on either side of the boundary.\\n\\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\\nVMAs registered by declare_kernel_vmas(). However, since commit\\n5973a62efa34 (\\\"arm64: map [_text, _stext) virtual address range\\nnon-executable+read-only\\\"), the early mapper also maps [_text, _stext)\\nseparately from [_stext, _etext). This adds one more early-only split\\nand can require one more page-table page than the existing\\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\\n\\nIncrease the 4K-page early mapping allowance by one page to cover that\\nadditional split.\\n\\n[catalin.marinas@arm.com: rewrote part of the commit log]\\n[catalin.marinas@arm.com: expanded the code comment]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/include/asm/kernel-pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fdd380a5950503a07aaaf74536a0c2f223475eb0\",\"lessThan\":\"a4ff33053da0a34b14abb5c96dc5a48379e26fce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"dcb89deed40ba55ff7020061712fdabf098cc2cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"9fe9e3acaa14921b0cf0d6cc2de5b562499bf721\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5973a62efa34c80c9a4e5eac1fca6f6209b902af\",\"lessThan\":\"4d8e74ad4585672489da6145b3328d415f50db82\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88025faf2aa08c7468d68d8cb31a53b55aae6ee0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.54\",\"lessThan\":\"6.12.91\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.17.4\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/include/asm/kernel-pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.54\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"BECAD95D-655A-4E27-8005-7A599FD0280A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.17.4\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"3B2D0531-24AE-45F8-BE6F-5DD45B339658\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-29T09:58:43+00:00",
      "cve": "CVE-2026-53288",
      "id": "CVE-2026-53288",
      "initial_release_date": "2026-06-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: Reserve an extra page for early kernel mapping",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53288.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.