CVE-2026-53020 is a vulnerability in the Linux kernel's User-Mode Linux (UML) subsystem related to a potential race condition during Translation Lookaside Buffer (TLB) synchronization. The flaw arises because the page table lock was not properly held while traversing and modifying the page table, risking inconsistent memory states. This issue was resolved by disabling the split page table lock to simplify synchronization. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related package versions. Ubuntu has released patched kernel versions to address this issue, requiring users to update and reboot. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

The vulnerability allows a local attacker with low privileges to exploit a race condition in the TLB synchronization process, potentially leading to full system compromise by affecting confidentiality, integrity, and availability of the system. The CVSS score of 7.8 reflects the high severity of the impact if exploited. However, there are no known exploits in the wild at this time.

A patch is available and has been released by Ubuntu in the form of updated Linux kernel packages (version 7.0.0-28.28 and later). Users should apply the updates promptly and reboot their systems to ensure the fixes take effect. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor advisory instructions for updating and rebuilding kernel modules as needed.