CVE-2026-53189: Linux Kernel Use-After-Free in Huge Page Memory Management

Technical summary

CVE-2026-53189 is a use-after-free vulnerability in the Linux kernel's mm/huge_memory subsystem, specifically in __split_huge_pmd_locked(). When splitting a PMD (Page Middle Directory) mapping, the function updates file/shmem RSS counters after invoking folio_put() to drop the mapping's folio reference. If folio_put() releases the final reference, the folio is freed; subsequent calls to mm_counter_file() can then dereference freed memory via folio_test_swapbacked(). The vulnerability is resolved by moving the counter update before the folio_put() call, ensuring all memory state reads occur on valid, referenced memory. The fix eliminates the window where freed folio state can be accessed.

Business impact

This vulnerability poses a direct risk to infrastructure relying on Linux kernels in production. Exploitation by local attackers with standard user privileges can trigger kernel memory corruption, leading to system instability, unexpected reboots, or data integrity issues. In multi-tenant environments, a compromised tenant could destabilize shared systems. The HIGH severity rating reflects the combination of local privilege escalation potential and high impact on system availability and confidentiality.

Affected systems

The vulnerability affects the Linux kernel across all distributions and versions that incorporate the vulnerable code in mm/huge_memory. Any Linux system running a kernel prior to the patched version is susceptible. This includes enterprise distributions (RHEL, SLES, Ubuntu LTS), cloud instances, and embedded Linux systems. Verify your specific kernel version against vendor advisories from Red Hat, SUSE, Canonical, and other distribution maintainers for exact patched versions.

Exploitability

The vulnerability requires local access and standard user-level privileges (no root needed). It is not publicly disclosed with a functional exploit, but the memory corruption primitive is exploitable by a motivated attacker to trigger kernel crashes or potentially elevate privileges. The barrier to exploitation is moderate—triggering the race condition requires crafting memory pressure or specific folio reference patterns, but once understood, the attack surface is reasonable. The CVSS vector (AV:L/AC:L/PR:L) confirms local, low-complexity exploitation.

Remediation

Apply kernel patches from your Linux distribution vendor. The fix is a minimal reordering of code in __split_huge_pmd_locked() to move the mm_counter_file() call before folio_put(). Verify against vendor advisories for the specific patched kernel version for your distribution. Test patches in a staging environment before production deployment, particularly for systems with high page cache turnover or transparent huge page (THP) activity.

Patch guidance

Obtain and deploy kernel updates from your distribution maintainer (Red Hat, SUSE, Canonical, Oracle, etc.). The patch is a single-line or multi-line reordering; it is minimal and low-risk. Prioritize patching systems with THP enabled (common in modern distributions) and systems handling large working sets. Kernel updates typically require a reboot; schedule maintenance windows accordingly. Verify the kernel version post-reboot using 'uname -r' and confirm the patched version matches your vendor advisory.

Detection guidance

Monitor kernel logs (dmesg, systemd journal) for BUGs, page faults, or memory corruption warnings coinciding with transparent huge page (THP) activity or large memory page splits. Kernel address sanitizers (KASAN) or CONFIG_DEBUG_PAGEALLOC may reveal use-after-free access patterns. Correlation of system crashes with heavy memory workloads (large database operations, container churn) can indicate exploitation. Intrusion detection systems should flag anomalous syscalls or memory allocation patterns from unprivileged processes. However, exploitation may be silent if the freed folio data is not immediately accessed by user-space code.

Why prioritize this

CVE-2026-53189 should be prioritized for patching due to its HIGH CVSS score (7.8), local privilege escalation potential, and applicability across all Linux distributions. While not in the KEV catalog, the vulnerability's presence in core memory management code and ease of triggering make it attractive to sophisticated attackers. Systems with THP enabled or handling large working sets face elevated risk. Patch urgently, but after validation in staging.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Local Attack Vector (no network exposure), Low Attack Complexity (no special conditions required), Low Privileges Required (standard user), No User Interaction, and high impact on Confidentiality, Integrity, and Availability. The vulnerability directly affects kernel memory safety, justifying the high confidentiality and integrity ratings. The scope is Unchanged (kernel-level impact, but no sandbox escape needed). The score correctly weighs the local nature against the severity of memory corruption and privilege escalation potential.

Frequently asked questions