CVE-2026-53153 mm/list_lru: drain before clearing xarray entry on reparent
A race condition in the Linux kernel's list_lru reparenting logic allows concurrent threads to corrupt list pointers, potentially leading to system crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53153?
CVE-2026-53153 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/list_lru: drain before clearing xarray entry on reparent
memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list.
If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links.
Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.
Weakness: CWE-820
Which versions are affected by CVE-2026-53153?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Linux.
How do I fix CVE-2026-53153?
Apply the vendor's patch.
Is CVE-2026-53153 being exploited?
There is no known exploitation of CVE-2026-53153 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53153, DEBIAN-CVE-2026-53153, GHSA-x5g3-hx3c-gfxx, UBUNTU-CVE-2026-53153.