CVE-2026-53343In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP s…
Updated under an hour ago ()
Does this affect you?
It affects linux_kernel. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow") added a dummy read from the KASAN VMAP stack shadow in __switch_to(). The read uses ldr, but the KASAN shadow address is byte-granular and is not guaranteed to be word aligned. ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to() with an alignment exception before reaching init. Use ldrb for the dummy shadow access. The code only needs to fault in the shadow mapping if the stack shadow is missing, so a byte load is sufficient and matches the granularity of KASAN shadow memory.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jul 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
linux linux_kernel linux:linux_kernel | from 6.1.120 before 6.1.176; from 6.6.64 before 6.6.143; from 6.12.4 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; and 4 more ranges | NVD |
References
- https://git.kernel.org/stable/c/2a4dc9a0ac3326e79fb58fdaae724b92127709a9patch
- https://git.kernel.org/stable/c/517720913bd3c17a52cd55a740064f68455ab88epatch
- https://git.kernel.org/stable/c/77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6patch
- https://git.kernel.org/stable/c/c0b8c148a7754826156993ed6442d31536ec86b4patch
- https://git.kernel.org/stable/c/c2e3aadc8fef7da068490597fc5582f8f362aeb2patch
- https://git.kernel.org/stable/c/c74990828d3c486ee44aaa68240eb3abff289d1cpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.