CVE-2026-53153
mm/list_lru: drain before clearing xarray entry on reparent
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.10% · top 99% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af – < c19ff4351214f059349788e13e70e74325831ff6
- affected fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af – < 2b66496d794e98f7aeec7688573051f22ec40bac
- affected fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af – < 98733f3f0becb1ae0701d021c1748e974e5fa55c
- affected 6.13
- unaffected < 6.13
- unaffected 6.18.36 – ≤ 6.18.*
- unaffected 7.0.13 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References (7)
- https://git.kernel.org/stable/c/c19ff4351214f059349788e13e70e74325831ff6 (opens in a new tab)
- https://git.kernel.org/stable/c/2b66496d794e98f7aeec7688573051f22ec40bac (opens in a new tab)
- https://git.kernel.org/stable/c/98733f3f0becb1ae0701d021c1748e974e5fa55c (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-53153 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2492790 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53153.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:61887 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-53153)Record last updated .