CVE-2026-53288: ARM64 Linux Kernel Page Table Overflow During Early Boot

Technical summary

CVE-2026-53288 addresses a page table allocation insufficiency in ARM64 early kernel mapping. The vulnerability arises from a mismatch between segment alignment (64KB) and block entry sizes (2MB for 4K pages). When segment boundaries fall within a 2MB block, separate page table entries are required to enforce different memory attributes. A prior commit (5973a62efa34) introduced an additional early-only split by mapping [_text, _stext) separately from [_stext, _etext), increasing the total splits beyond what EARLY_SEGMENT_EXTRA_PAGES reserves. This can cause the [data, end) segment to overflow into init_pg_end[1], the gap page before early_init_stack[2], corrupting critical initialization structures. The fix increases the 4K-page early mapping reserve by one additional page.

Business impact

Systems relying on ARM64 Linux deployments face potential boot failures or early-stage kernel panics. Cloud environments and data centers using ARM64-based infrastructure (such as Graviton instances or ARM servers) may experience unexpected downtime if affected kernel versions are running. The impact is primarily availability-focused; affected systems may become unreliable or fail to boot entirely, disrupting service continuity. Organizations running production ARM64 Linux workloads should assess whether this affects their kernel versions and prioritize testing patched builds in non-production environments before rolling out.

Affected systems

The Linux kernel across all supported versions is affected. The vulnerability is specific to ARM64 architecture with 4K page configurations where early kernel mapping occurs. Systems using other architectures (x86, PowerPC, RISC-V) are not impacted. Particularly vulnerable are ARM64 systems that have received the commit 5973a62efa34 or later, which introduces the triggering condition. Enterprise ARM64 deployments, including cloud instances and embedded systems running Linux, should be assessed.

Exploitability

This is a kernel memory corruption vulnerability triggered during early boot initialization. Exploitation requires local system access and the ability to trigger specific memory mapping conditions during kernel initialization. The vulnerability cannot be exploited remotely or by unprivileged users in a running system; it manifests as a reliability issue rather than a security bypass. The practical impact is system instability and potential denial of service through boot failure rather than privilege escalation or data exfiltration.

Remediation

Apply a kernel patch that increases EARLY_SEGMENT_EXTRA_PAGES by one page for 4K-page ARM64 configurations. The fix is straightforward: reserve an additional page table page in the early mapping allocation to accommodate the extra split introduced by separate [_text, _stext) mapping. Affected systems should upgrade to patched kernel versions once available from their distribution or vendor. Testing should focus on verifying successful boot and stability of ARM64 systems, particularly those using 4K page sizes.

Patch guidance

Monitor Linux kernel release notes and your distribution's security advisories for patched versions. Verify that the patch specifically addresses EARLY_SEGMENT_EXTRA_PAGES allocation for ARM64. Before applying to production, test the patched kernel in a staging environment that mirrors your ARM64 deployment configuration. Pay particular attention to boot sequences and early kernel initialization logs to confirm the fix resolves any previously observed crashes or boot hangs. If using a vendor-provided kernel (cloud provider or embedded system manufacturer), request confirmation that their kernel includes this fix.

Detection guidance

Monitor system logs for ARM64 kernel panics or boot failures that occur immediately after kernel initialization, particularly those involving page table corruption or stack corruption messages. Use crash analysis tools (crash utility) to examine memory dumps and verify whether overflow into the early_init_stack region has occurred. Check kernel version and configuration: systems running ARM64 with 4K pages and kernel versions after commit 5973a62efa34 are candidates for verification. Implement automated boot testing in your CI/CD pipeline to catch boot failures early if you maintain custom ARM64 kernels.

Why prioritize this

Although the CVSS score is moderate (5.5), the practical impact on system availability is significant. This vulnerability directly affects boot reliability of ARM64 systems, making it critical for any organization running ARM64 Linux in production. A boot-time crash is more damaging to availability than many higher-scored vulnerabilities that require active exploitation. Prioritize patching based on the criticality of ARM64 infrastructure in your environment; if ARM64 is central to your cloud or data center operations, treat this as high priority despite the moderate CVSS score.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector with low privileges required, no user interaction, and no scope change, resulting in availability impact (system crashes). However, this score may understate practical risk for ARM64-dependent infrastructure. The vulnerability guarantees availability loss for affected systems during boot, unlike many scored vulnerabilities that require specific exploitation conditions. Organizations with significant ARM64 deployments should weight this toward higher internal priority than the numerical CVSS suggests.

Frequently asked questions