9.8

CVE-2026-53309: linux Off-by-one Error

CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-53309DEBIAN-CVE-2026-53309
Published 26-06-2026Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2026-53309 is a critical (CVSS 9.8) Off-by-one Error vulnerability in linux. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 63 · Related 64
OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:23881-1

Timeline

  1. 26-06-2026
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu166 products
  • linux< 3.13.0-217.268 | < 4.4.0-287.321 | < 4.15.0-257.269 | < 5.4.0-238.258 | < 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1158.164 | < 4.4.0-1196.211 | < 4.15.0-1196.209 | < 5.4.0-1163.174 | < 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ ea2034416b54700e30371f2ad6517cbb94674083, < 760ab35040aca8399021fdb9ff1db1089feb7194 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < c60a2710b73838d250cda57344c049b89abc5d52 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < 2a0673836f019e7c032acbf48d022d5ccf02a845 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < 819d8ebad3200a53de99bd7e297bc428e41ced54 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < d5403ae28085761d58b555645bc7d5feadb10073 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < 1fb7f356547d9688822315cd2b205ff0bd5429b4 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < 426cd8eedac89b86148d4478990eeef16e8a2520 | ≥ ea2034416b54700e30371f2ad6517cbb94674083, < 01b61e8dda9b0fdb0d4cda43de25f4e390554d7b | 2.6.37
  • linux_kernel≥ 2.6.37, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1

3 vendors · 169 products

References

64 links
Show all 64 references