CVE-2026-53243

Analyzed Analyzed - Analysis Complete

Kernel Information Leak in Linux Kernel rseq

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53243

EUVD

EUVD-2026-39194

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 7.0.10 (inc) to 7.0.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Mitigation Strategies

The vulnerability is fixed by modifying the Linux kernel source code to avoid using an uninitialized stack variable in the rseq_exit_user_update() function.

Specifically, the fix involves moving the assignment of the node_id field outside the structure initialization to ensure proper initialization order.

Therefore, the immediate mitigation step is to update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability is a bug in the Linux kernel related to the use of an uninitialized stack variable in the function rseq_exit_user_update().

Specifically, a local variable struct rseq_ids named ids is initialized with multiple fields, but due to the indeterminate evaluation order of expressions in the initializer list, the field ids.node_id is computed using ids.cpu_id before ids.cpu_id is actually initialized.

This causes the use of an uninitialized value, leading to a kernel information leak as detected by KMSAN (Kernel Memory Sanitizer).

The issue was fixed by moving the assignment of ids.node_id outside the structure initialization to ensure proper initialization order.

Impact Analysis

This vulnerability can lead to a kernel information leak, which means that sensitive kernel memory information could be exposed unintentionally.

Such leaks can potentially be exploited by attackers to gain insights into kernel memory layout or other sensitive data, which might aid in further attacks or privilege escalation.

Hi! I’m here to help you understand CVE-2026-53243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70