CyberSecBulletin
CVE-2026-53329NVD status: Modified

Linux: Uncontrolled Recursion

Published Updated By the CyberSecBulletin desk

CVE-2026-53329 is a high-severity uncontrolled recursion vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9540b0a4d13e4ede64ae1197d66a176d2149daa9, 31180638a33acad12c863132704a76536fb66211, b15825deac1acff72638bbc8f05b89ceef8dfb13 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 9540b0a4d13e4ede64ae1197d66a176d2149daa9 or 31180638a33acad12c863132704a76536fb66211 or b15825deac1acff72638bbc8f05b89ceef8dfb13 or 201151e120f0062bcda21cad5d007b82725ad23b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, 9540b0a4d13e4ede64ae1197d66a176d2149daa9; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, 31180638a33acad12c863132704a76536fb66211; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, b15825deac1acff72638bbc8f05b89ceef8dfb13; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, 201151e120f0062bcda21cad5d007b82725ad23b; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, a914aa802669e073f014dae2e5708633b5cecd34; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, e09689286385a66311ac6922af95339d7a3cef8d; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, de988c7a31f0774f07894cfe4802996f318e2870; 2004f45ef83f07f43f5da6ede780b08068c7583d up to, but not including, da48bc4461b8a5ebfb9264c9b191a701d8e99009; and 1 more ranges9540b0a4d13e4ede64ae1197d66a176d2149daa9, 31180638a33acad12c863132704a76536fb66211, b15825deac1acff72638bbc8f05b89ceef8dfb13, 201151e120f0062bcda21cad5d007b82725ad23b, a914aa802669e073f014dae2e5708633b5cecd34, e09689286385a66311ac6922af95339d7a3cef8d
LinuxLinux Kernel4.15 up to, but not including, 5.10.260; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.15.10.260, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How developers prevent this class of flaw

  • Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

More Uncontrolled Recursion vulnerabilities (CWE-674)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Uncontrolled Recursion vulnerabilities

Spotted an error? Tell us.