Linux: Irrelevant Code
CVE-2026-53356 is a high-severity irrelevant code vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 40f738991058eb3e3530c3006a5bd6fd5e29f035, 1ec8fc63e9cdb22da54e48e536c9204020416fc6, 14469860e2e39b7095dcd658d2bad38a11110a68 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 40f738991058eb3e3530c3006a5bd6fd5e29f035 or 1ec8fc63e9cdb22da54e48e536c9204020416fc6 or 14469860e2e39b7095dcd658d2bad38a11110a68 or 07c33be968d9e0cab6cba38c81850a09942fcb2e, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 40f738991058eb3e3530c3006a5bd6fd5e29f035; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 1ec8fc63e9cdb22da54e48e536c9204020416fc6; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 14469860e2e39b7095dcd658d2bad38a11110a68; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 07c33be968d9e0cab6cba38c81850a09942fcb2e; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 3bd168dd835b93a3862cd05b0d13c432b115f9d6; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, 32d4c5d328a3ff995420f4f85163e1e403f43628; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, dd51a2eeb93bc6faa892ff9083911dd23f82c187; c6790dc22312f592c1434577258b31c48c72d52a up to, but not including, d21ad938398bca695a511307de38a65889e3b354; and 1 more ranges | 40f738991058eb3e3530c3006a5bd6fd5e29f035, 1ec8fc63e9cdb22da54e48e536c9204020416fc6, 14469860e2e39b7095dcd658d2bad38a11110a68, 07c33be968d9e0cab6cba38c81850a09942fcb2e, 3bd168dd835b93a3862cd05b0d13c432b115f9d6, 32d4c5d328a3ff995420f4f85163e1e403f43628 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Linux | Linux Kernel | 5.7 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.1 | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Irrelevant Code
The product contains code that is not essential for execution, i.e., makes no state changes and has no side effects that alter data or control flow - or is unreachable under any circumstances - such that removal of the code would have no impact to intended functionality or correctness.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e
- git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68
- git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6
- git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628
- git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6
- git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035
- git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354
- git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187
Other references
Recent Irrelevant Code vulnerabilities
- 7.4 High severity
Spotted an error? Tell us.