CVE-2026-53243: Linux Kernel rseq Uninitialized Variable Information Leak

Technical summary

The vulnerability exists in rseq_exit_user_update() within the kernel's restartable sequences implementation. A struct `rseq_ids` is initialized with three fields: `cpu_id`, `mm_cid`, and `node_id`. However, the initialization of `node_id` uses `cpu_to_node(ids.cpu_id)` in the initializer list. Per the C standard, initializer list evaluation order is indeterminate; compilers like Clang may evaluate `cpu_to_node(ids.cpu_id)` before `ids.cpu_id` is assigned by `task_cpu(t)`, reading an uninitialized stack value. KMSAN (KernelMemorySanitizer) detected this kernel-infoleak. The fix moves the `node_id` assignment outside the structure initialization, ensuring `ids.cpu_id` is populated first.

Business impact

This vulnerability enables local users to read sensitive kernel memory, potentially bypassing ASLR and other mitigations or leaking cryptographic keys and other secrets. While exploitation requires local access and unprivileged execution context, successful exploitation can aid in follow-up attacks. Organizations relying on Linux kernel isolation guarantees between unprivileged processes and the kernel should treat this as a priority remediation target to maintain defense-in-depth against privilege escalation chains.

Affected systems

All versions of the Linux kernel containing the vulnerable rseq code are affected. The vulnerability requires a local user with the ability to trigger rseq subsystem operations—a capability available to any unprivileged process. Systems running unpatched kernel versions are at risk; patched versions after the fix date (2026-07-07) should be verified in vendor advisories and release notes.

Exploitability

Exploitability is rated MEDIUM (CVSS 5.5). The attack requires local access (AV:L) and does not depend on special privileges or user interaction (PR:L, UI:N). The impact is limited to confidentiality (kernel-infoleak), with no integrity or availability compromise from this vulnerability alone. However, the leaked kernel memory can serve as a stepping stone for further attacks. Active exploitation in the wild is not documented at this time (KEV status: not listed).

Remediation

Apply the kernel patch that resolves the uninitialized variable issue by moving `ids.node_id` assignment outside the initializer list. Verify the patch against your vendor's advisory and test in a non-production environment before deployment. Kernel updates typically require a reboot to take effect. Organizations should prioritize patching systems that expose rseq interfaces to untrusted local users.

Patch guidance

Consult your Linux distribution's security advisory for the specific kernel version and patch timeline. Patches are expected in stable kernel branches following the upstream fix (post-2026-07-07). When available, use your distribution's package manager (apt, yum, dnf, etc.) to update the kernel and reboot. For custom kernel builds, apply the upstream patch directly and recompile. Verify the patched kernel version before and after deployment.

Detection guidance

Monitor kernel logs for KMSAN reports or sanitizer warnings related to rseq_set_ids_get_csaddr and uninitialized variable usage. Kernel-infoleak detectors and memory sanitizers (KMSAN, KASAN if configured with poisoning) will surface this issue. In production systems without sanitizers, behavioral anomalies related to rseq operations may be subtle; focus on kernel update logs and patch status monitoring. Intrusion detection signatures are unlikely to catch this at runtime without instrumentation.

Why prioritize this

Although the CVSS score is moderate (5.5), the vulnerability represents a straightforward kernel-infoleak that can be triggered by any local unprivileged user. Information disclosure is a critical stepping stone for privilege escalation attacks, especially in defense-in-depth scenarios. The fix is well-understood and straightforward, reducing deployment risk. Organizations should prioritize this in their Linux kernel patching schedule, particularly for multi-tenant systems and containers where unprivileged user isolation is relied upon.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects a local-only attack vector (AV:L), low privilege requirement (PR:L), lack of user interaction (UI:N), and isolated scope (S:U). The primary impact is confidentiality (information leak); integrity and availability are not directly affected. The score appropriately weights the limited attack surface against the seriousness of kernel-infoleak primitives in escalation chains. No CVSS modifiers from environmental or threat factors are applied here.

Frequently asked questions