VulnerabilityPublished 24 Jun 2026Updated 21 Oct 2026

CVE-2026-53015: Linux kernel · erofs: unify lcn as u64 for 32-bit platforms

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 858e4d98a86adf34584767388deb6c9b217f70c5 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 858e4d98a86adf34584767388deb6c9b217f70c5, 582b0bf201157632cb5474c885989a6ebda46521, 18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982c +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 152a333a589560bee002e4c96761f1b560a5793c, < 858e4d98a86adf34584767388deb6c9b217f70c5	Fixed in 858e4d98a86adf34584767388deb6c9b217f70c5
LinuxLinux	Affected ≥ 152a333a589560bee002e4c96761f1b560a5793c, < 582b0bf201157632cb5474c885989a6ebda46521	Fixed in 582b0bf201157632cb5474c885989a6ebda46521
LinuxLinux	Affected ≥ 152a333a589560bee002e4c96761f1b560a5793c, < 18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982c	Fixed in 18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982c
LinuxLinux	Affected ≥ 152a333a589560bee002e4c96761f1b560a5793c, < 4fc9b12e43a3f19a01a8fb61f7961be79de20253	Fixed in 4fc9b12e43a3f19a01a8fb61f7961be79de20253
LinuxLinux	Affected ≥ 152a333a589560bee002e4c96761f1b560a5793c, < 2d8c7edcb661812249469f4a5b62e9339118846f	Fixed in 2d8c7edcb661812249469f4a5b62e9339118846f
LinuxLinux	Affected =5.3	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: unify lcn as u64 for 32-bit platforms As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB. In order to consolidate the logic, just use `u64` consistently around the codebase. [1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com

References

Community reviews

Loading reviews…