CVE-2026-53326: Linux Kernel PREEMPT_RT ARM64 Boot Deadlock

Technical summary

CVE-2026-53326 addresses a deadlock scenario in the Linux kernel's debugobjects subsystem triggered by a race condition during early boot. On ARM64 PREEMPT_RT kernels, there is a narrow window between when interrupts are enabled and when the scheduler initializes (before SYSTEM_SCHEDULING is set). If a hardware interrupt fires during this window and the interrupt handler attempts to allocate from the debug object pool via fill_pool(), it can collide with locks held in the allocation path. The vulnerability is rooted in improper ordering of exception checks in the pool allocation logic. The resolution introduces a can_fill_pool() helper function that enforces a rule excluding hard interrupt context allocations from the pool fill operation.

Business impact

Systems running production PREEMPT_RT kernels on ARM64 hardware face potential unscheduled downtime due to kernel-level deadlocks during boot. While the vulnerability is triggered only during a specific early-boot window and primarily affects real-time Linux deployments (used in industrial control, automotive, and telecoms), affected systems may fail to boot reliably, complicating infrastructure reliability. Organizations using real-time Linux in mission-critical environments should prioritize patching to restore boot stability.

Affected systems

Linux kernel systems on ARM64 architecture running PREEMPT_RT (real-time preemption) kernels are affected. Standard non-real-time Linux kernels are not affected. The vulnerability manifests during system startup only. Affected distributions include any ARM64-based Linux distribution that enables kernel debugging (CONFIG_DEBUG_OBJECTS) and real-time preemption options (CONFIG_PREEMPT_RT). Verify your kernel configuration and architecture before assessing risk.

Exploitability

This is not a remotely exploitable vulnerability. It requires local system access and manifests only during early boot of PREEMPT_RT kernels on ARM64 systems with debugging enabled. The window is deterministic and automatic—no attacker action is needed to trigger it. A user with boot access could potentially leverage repeated boot failures to deny service, but the practical attack vector is limited. The main concern is unintended system unavailability rather than active exploitation.

Remediation

Apply a kernel patch that includes the can_fill_pool() helper function and reordered allocation exception rules to prevent fill_pool() calls from hard interrupt context during early boot. Verify the patch is included in your distribution's kernel package. After patching, rebuild and test the kernel on affected ARM64 PREEMPT_RT systems to confirm stable boot. If you do not run PREEMPT_RT or do not have CONFIG_DEBUG_OBJECTS enabled, no action is required.

Patch guidance

Obtain the Linux kernel patch from your distribution's security update channel or from kernel.org. The patch introduces a can_fill_pool() helper to enforce the restriction on hard interrupt context allocations. Test the patched kernel on a representative ARM64 PREEMPT_RT system across multiple boot cycles to confirm the lockdep warning is resolved and boot is stable. Coordinate patching with your system maintenance windows, as it requires a kernel rebuild and reboot. Verify the patch hash and signature before deployment.

Detection guidance

On affected systems, monitor kernel logs during boot for the lockdep warning: 'inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage'. Document the occurrence and system configuration. Post-patch, verify the warning is absent across multiple reboots. Enable CONFIG_DEBUG_LOCKDEP if available to increase detection sensitivity for similar issues. Monitor kernel panic logs and boot failures on ARM64 PREEMPT_RT systems for any deadlock signatures during the early boot phase.

Why prioritize this

Although CVSS 5.5 (MEDIUM) reflects local scope and required authentication, the practical impact for affected deployments is high: boot failures in production real-time systems are unacceptable. PREEMPT_RT is primarily used in safety-critical and real-time environments where downtime is costly. However, the attack surface is extremely narrow (early boot only, specific architecture and kernel config), so mainstream Linux users are unaffected. Prioritize this patch if you operate ARM64 PREEMPT_RT infrastructure; deprioritize if you run standard Linux kernels.

Risk score, explained

CVSS 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high availability impact (A:H). The score appropriately captures the severity of a denial-of-service condition, but does not reflect the narrow scope of affected configurations. Organizations should apply their own risk multiplier based on whether they operate ARM64 PREEMPT_RT deployments; if they do not, the practical risk score approaches zero.

Frequently asked questions