In the Linux kernel, the following vulnerability has been resolved: blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()… (CVE-2026-53319)
In the Linux kernel, the following vulnerability has been resolved: blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default() wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from wbt_alloc() and wbt_init(). However, both are expected failure paths: - wbt_alloc() can return NULL under memory pressure (-ENOMEM) - wbt_init() can fail with -EBUSY if wbt is already registered syzbot triggers this by injecting memory allocation failures during MTD partition creation via ioctl(BLKPG), causing a spurious warning. wbt_init_enable_default() is a best-effort initialization called from blk_register_queue() with a void return type. Failure simply means the disk operates without writeback throttling, which is harmless. Replace WARN_ON_ONCE with plain if-checks, consistent with how wbt_set_lat() in the same file already handles these failures. Add a pr_warn() for the wbt_init() failure to retain diagnostic information without triggering a full stack trace.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-53319 concerns the blk-wbt subsystem's wbt_init_enable_default() function, which improperly uses WARN_ON_ONCE to flag expected failure paths from wbt_alloc() and wbt_init(). These failures can occur under memory pressure (-ENOMEM) or if writeback throttling is already registered (-EBUSY). This causes spurious kernel warnings and stack traces triggered by syzbot during memory allocation failure injection. The fix replaces WARN_ON_ONCE with simple if-checks and a pr_warn() call to retain diagnostic information without causing full stack traces. The function is best-effort and void-returning, so failure only disables writeback throttling without functional impact.
Potential Impact
This vulnerability does not affect confidentiality, integrity, or normal availability of the system. The impact is limited to causing spurious kernel warnings and stack traces, which may confuse diagnostics or clutter logs. The disk continues to operate normally but without writeback throttling, which is a performance feature rather than a security control. There are no known exploits in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to replace WARN_ON_ONCE with conditional checks and pr_warn() in wbt_init_enable_default(). Users should update to the fixed kernel version once available. Since this is a code quality and warning suppression fix with no functional impact, no urgent action is required beyond applying the official patch when released. Patch status is not explicitly confirmed here; check the vendor advisory or Linux kernel mailing lists for the specific fixed version.
In the Linux kernel, the following vulnerability has been resolved: blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()… (CVE-2026-53319)
Description
In the Linux kernel, the following vulnerability has been resolved: blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default() wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from wbt_alloc() and wbt_init(). However, both are expected failure paths: - wbt_alloc() can return NULL under memory pressure (-ENOMEM) - wbt_init() can fail with -EBUSY if wbt is already registered syzbot triggers this by injecting memory allocation failures during MTD partition creation via ioctl(BLKPG), causing a spurious warning. wbt_init_enable_default() is a best-effort initialization called from blk_register_queue() with a void return type. Failure simply means the disk operates without writeback throttling, which is harmless. Replace WARN_ON_ONCE with plain if-checks, consistent with how wbt_set_lat() in the same file already handles these failures. Add a pr_warn() for the wbt_init() failure to retain diagnostic information without triggering a full stack trace.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-53319 concerns the blk-wbt subsystem's wbt_init_enable_default() function, which improperly uses WARN_ON_ONCE to flag expected failure paths from wbt_alloc() and wbt_init(). These failures can occur under memory pressure (-ENOMEM) or if writeback throttling is already registered (-EBUSY). This causes spurious kernel warnings and stack traces triggered by syzbot during memory allocation failure injection. The fix replaces WARN_ON_ONCE with simple if-checks and a pr_warn() call to retain diagnostic information without causing full stack traces. The function is best-effort and void-returning, so failure only disables writeback throttling without functional impact.
Potential Impact
This vulnerability does not affect confidentiality, integrity, or normal availability of the system. The impact is limited to causing spurious kernel warnings and stack traces, which may confuse diagnostics or clutter logs. The disk continues to operate normally but without writeback throttling, which is a performance feature rather than a security control. There are no known exploits in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to replace WARN_ON_ONCE with conditional checks and pr_warn() in wbt_init_enable_default(). Users should update to the fixed kernel version once available. Since this is a code quality and warning suppression fix with no functional impact, no urgent action is required beyond applying the official patch when released. Patch status is not explicitly confirmed here; check the vendor advisory or Linux kernel mailing lists for the specific fixed version.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8mp9-p9g8-5rm9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53319"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c33fd27e9c797195f27f5
Added to database: 07/06/2026, 23:02:21 UTC
Last enriched: 07/06/2026, 23:09:12 UTC
Last updated: 07/31/2026, 19:24:48 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.