CyberSecBulletin
CVE-2026-53062NVD status: Modified

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2026-53062 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 4991b5a08751e2e82488fb93ae08849b6aea10d9, 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513, 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 4991b5a08751e2e82488fb93ae08849b6aea10d9 or 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513 or 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e or ac5ee99443891bdb161f5539606a66a1b5e72542, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.141, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 4991b5a08751e2e82488fb93ae08849b6aea10d9; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, ac5ee99443891bdb161f5539606a66a1b5e72542; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 93627a29d4b66d4a2def938dfb8610cc80ae454b; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, c348ae47d8e65f06429fa41adce9ad986b696766; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 2b62d0611c9af14a16bddf22df2612b4f40eb5a1; b29d4986d0da1a27cd35917cdb433672f5c95d7f up to, but not including, 2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45; and 1 more ranges4991b5a08751e2e82488fb93ae08849b6aea10d9, 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513, 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e, ac5ee99443891bdb161f5539606a66a1b5e72542, 93627a29d4b66d4a2def938dfb8610cc80ae454b, c348ae47d8e65f06429fa41adce9ad986b696766
LinuxLinux Kernel4.12 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.141; 6.7 up to, but not including, 6.12.91; 6.13 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.105.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up with data races on the allocated blocks counter, or even use-after-free issues with internal data structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't affect passthrough mode since migration tasks don't exist there, but would need attention if supporting fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache device consisting of 1024 cache entries dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Populate the cache, and record the number of cached blocks fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the passthrough cache. By setting multiple jobs with I/O size equal to the cache block size, cache blocks are invalidated concurrently from different workers. fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \ --direct=1 --numjobs=2 --randrepeat=0 --size=64m 5. Check if demoted matches cached block count. These numbers should match but may differ due to the data race. nr_demoted=$(dmsetup status cache | awk '{print $12}') echo "$nr_cached, $nr_demoted"

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.