CVE-2026-53243

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/6d99479799c69c3cb588fcda19c81d8f61d64ecd
https://git.kernel.org/stable/c/e12d20a63b61aaf9de4772effccf42cc9a003e58

Configurations

No configuration.

History

25 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 09:16

Updated : 2026-06-30 14:44

NVD link : CVE-2026-53243

Mitre link : CVE-2026-53243

CVE.ORG link : CVE-2026-53243

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53243", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d242126fd21ab8f1631fdbc8589e43a9d4229f3b", "lessThan": "e12d20a63b61aaf9de4772effccf42cc9a003e58", "versionType": "git"}, {"status": "affected", "version": "82f572449cfe75f12ea985986da60e11f308f77d", "lessThan": "6d99479799c69c3cb588fcda19c81d8f61d64ecd", "versionType": "git"}], "programFiles": ["include/linux/rseq_entry.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7.0.10", "lessThan": "7.0.13", "versionType": "semver"}], "programFiles": ["include/linux/rseq_entry.h"], "defaultStatus": "unaffected"}]}], "published": "2026-06-25T09:16:42.260", "references": [{"url": "https://git.kernel.org/stable/c/6d99479799c69c3cb588fcda19c81d8f61d64ecd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e12d20a63b61aaf9de4772effccf42cc9a003e58", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Fix using an uninitialized stack variable in rseq_exit_user_update()\n\nThere is an bug in which an uninitialized stack variable is used in\nrseq_exit_user_update() as reported by syzbot:\n\nBUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]\n\nThe local variable:\n\n\tstruct rseq_ids ids = {\n\t\t.cpu_id\t = task_cpu(t),\n\t\t.mm_cid\t = task_mm_cid(t),\n\t\t.node_id = cpu_to_node(ids.cpu_id),\n\t};\n\nAccording to the C standard, the evaluation order of expressions in an\ninitializer list is indeterminately sequenced. The compiler (Clang, in\nthis KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before*\n`ids.cpu_id` is initialized with `task_cpu(t)`.\n\nThis is fixed by moving the assignment of ids.node_id outside the\nstructure initialization."}], "lastModified": "2026-06-30T14:44:27.313", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}