CVE-2026-53277: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
Vulnerability summary
CVE-2026-53277 is a high (CVSS 8.8) Improper Synchronization vulnerability in linux. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.1% of scored vulnerabilities.
Not severe (CVSS 8.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 25 · Related 24Timeline
- 25-06-2026PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking kvm->srcu. Fix by acquiring kvm->srcu prior to the table walk in both instances.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.15% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
- CWE-820Missing SynchronizationThe product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu118 products
- linuxAll versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard11 products
- linux-aws-6.12All versions (No fix recorded)
- linux-azure-6.12All versions (No fix recorded)
- linux-azure-6.18< 6.18.38-r0
- linux-gcp-6.12All versions (No fix recorded)
- linux-gcp-6.18< 6.18.38-r0
Linux2 products
- linux≥ be04cebf3e78874627dc1042991d5d504464a5cc, < 0648b375aa951cc15d9e90f9ac4de71e0b51fa45 | ≥ be04cebf3e78874627dc1042991d5d504464a5cc, < 97706097f9b851cfe55c3b00b083dfc2bcf542bc | ≥ be04cebf3e78874627dc1042991d5d504464a5cc, < ec42b4ed1b072ea2d03f086061aa67bad6d8de39 | ≥ be04cebf3e78874627dc1042991d5d504464a5cc, < f2ca45b50d4216c9cc7ffabf50d9ad1932209251 | 6.12
- linux_kernel≥ 6.12, < 6.18.36 | ≥ 6.19, < 7.0.13 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5 | 7.1:rc6
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.115-2 | < 7.0.13-1
4 vendors · 132 products
References
32 links- access.redhat.com/security/cve/CVE-2026-53277VDB EntryX Refsource REDHATAdvisoryThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2492725Issue TrackingX Refsource REDHATREPORTThird Party Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53277.jsonX Sadp Csaf VexWEBThird Party Advisory
