CVE-2026-53243 Details
Description
In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization.
A vulnerability has been identified in the Linux kernel's RSEQ (restartable sequences) implementation, specifically within the 'rseq_exit_user_update()' function. This issue arises from the use of an uninitialized stack variable, which can lead to a kernel information leak. The problem was reported by syzbot and is related to the order of expression evaluation in the C programming language. In this case, the compiler (Clang) evaluated a node ID conversion before the corresponding CPU ID was properly initialized, creating a potential information leak. This vulnerability affects the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel stable tree to address this vulnerability. The specific commit that resolves this issue is '6d99479799c69c3cb588fcda19c81d8f61d64ecd', which is included in the latest Linux kernel releases.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/6d99479799c69c3cb588fcda19c81d8f61d64ecd | kernel.org | Patch |
| https://git.kernel.org/stable/c/e12d20a63b61aaf9de4772effccf42cc9a003e58 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 7.0.10, < 7.0.13 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | New CVE Received | kernel.org |