VulnerabilityPublished 1 Jul 2026Updated 30 Oct 2026

CVE-2026-53345: Linux kernel · Memory Leak

Source GCVE Database

Authoritative record:CVE-2026-53345· Low

Not known to be exploited · CVSS 5.5 Low · fixed in 8618004d3e897c0f1b71d9a9ab860461289bb89a : update Linux kernel when convenient.

Data as of 30 Oct 2026, 16:33 UTC

CVSS 3.1 base score

5.5Low

How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none

Patch: Available – fixed in 8618004d3e897c0f1b71d9a9ab860461289bb89a, 343e95c8ecc40e0738975ef4ee24c0c35e800e6b, 99d7d43784ae3235026581e9bf892c036e04c8e6 +3

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-m28w-5q4v-5m48

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 8618004d3e897c0f1b71d9a9ab860461289bb89a	Fixed in 8618004d3e897c0f1b71d9a9ab860461289bb89a
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 343e95c8ecc40e0738975ef4ee24c0c35e800e6b	Fixed in 343e95c8ecc40e0738975ef4ee24c0c35e800e6b
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 99d7d43784ae3235026581e9bf892c036e04c8e6	Fixed in 99d7d43784ae3235026581e9bf892c036e04c8e6
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 66a8e7ddd901023c89a2733494d827eca3f9c1b0	Fixed in 66a8e7ddd901023c89a2733494d827eca3f9c1b0
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 033d39e41fc30f484f4e4f37fb4cd76b12cbb18e	Fixed in 033d39e41fc30f484f4e4f37fb4cd76b12cbb18e
LinuxLinux	Affected ≥ 2efd61a608b0039911924d2e5d7028eb37496e85, < 21b880f040bd0e8b50ff30c5a40db7bf3384ff48	Fixed in 21b880f040bd0e8b50ff30c5a40db7bf3384ff48

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying When marking a page dirty, complain about not having a running/loaded vCPU if and only if the VM is still alive, i.e. its refcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES guests without hitting what is effectively a false positive on the WARN. For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an exit to userspace, and typically unmaps the page on the next KVM_RUN. But if userspace never calls KVM_RUN after such an exit, then KVM needs to unmap the page when the vCPU is destroyed, which in turn triggers the WARN about not having a running vCPU. Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, as is done in nested_vmx_free_vcpu() (but for completely unrelated reasons; suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But loading a vCPU during destruction is gross (ideally nVMX code would be cleaned up), risks complicating the SEV-ES code (KVM would need to ensure the temporarily load()+put() only runs when the vCPU isn't already loaded), and is ultimately pointless. The motivation for the WARN is to guard against KVM dirtying guest memory without pushing the corresponding GFN to the active vCPU's dirty ring, e.g. to ensure userspace doesn't miss a dirty page. But for the VM's refcount to reach zero, there can't be _any_ userspace mappings to the dirty ring, as mapping the dirty ring requires doing mmap() on the vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then the vCPU file and thus the owning VM would still be alive. And so since userspace can't possibly reach the dirty ring, whether or not KVM technically "misses" a push to the dirty ring is irrelevant.

CWE-401Missing Release of Memory after Effective Lifetime (opens in a new tab)
Variant weaknessLikelihood of exploit: Medium
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Implementation · Libraries or Frameworks
Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Architecture and Design · Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

WeaknessesCWE-401

Technical details

References

Community reviews

Related threats