CVE-2026-53333 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
A logic error in the Linux kernel's mincore function can cause spurious warnings and incorrect page residency reporting on kernels without swap support but with migration or memory failure features enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53333?
CVE-2026-53333 is a medium-severity denial of service vulnerability in Linux kernel, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
mincore_swap() also fields migration/hwpoison entries (and shmem swapin-error entries), which can exist on !CONFIG_SWAP builds when CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled. The !IS_ENABLED(CONFIG_SWAP) guard ran before the non-swap-entry early return, so mincore_pte_range() can spuriously WARN and report these pages nonresident on !CONFIG_SWAP kernels.
Move the guard below the non-swap-entry check so only true swap entries trip the WARN, and migration/hwpoison entries take the existing "uptodate / non-shmem" path.
Which versions are affected by CVE-2026-53333?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53333?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53333 being exploited?
There is no known exploitation of CVE-2026-53333 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53333, DEBIAN-CVE-2026-53333, GHSA-hmwj-3ghp-wjg8, UBUNTU-CVE-2026-53333.