CVE-2026-53288: Linux Kernel Privilege Escalation Flaw

CVE-2026-53288 Overview

CVE-2026-53288 affects the Linux kernel's arm64 architecture early boot mapping code. The vulnerability stems from insufficient page reservation for the early kernel mapping on systems using 4K pages. The final portion of the [data, end) segment can overflow into the next page of init_pg_end, which is the gap page before early_init_stack. Since commit 5973a62efa34 introduced a separate non-executable read-only mapping for [_text, _stext), the early mapper performs one additional split that the existing EARLY_SEGMENT_EXTRA_PAGES allowance does not cover. The fix increases the 4K-page early mapping allowance by one page.

Critical Impact
Early kernel page-table allocation may exhaust its reserved capacity, leading to memory corruption of adjacent kernel structures during boot on arm64 systems using 4K pages.

Affected Products

Linux kernel on arm64 architecture with 4K page configuration
Kernel builds incorporating commit 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only")
Upstream Linux stable branches prior to the fix commits

Discovery Timeline

2026-06-26 - CVE-2026-53288 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53288

Vulnerability Analysis

The vulnerability resides in the arm64 early kernel mapping logic. On arm64 with 4K pages, the early mapper may use 2MB block entries, but kernel segments are only aligned to 64KB. When a segment boundary falls inside a 2MB block, the mapper must promote the block to a page-table entry (PTE) table to apply different attributes on either side of the boundary. Each such promotion consumes an additional page-table page from a fixed reserve.

KERNEL_SEGMENT_COUNT counts the five permanent kernel virtual memory areas registered by declare_kernel_vmas(). However, commit 5973a62efa34 introduced an additional early-only mapping split by mapping [_text, _stext) separately from [_stext, _etext). This extra split can require one more page-table page than EARLY_SEGMENT_EXTRA_PAGES reserved.

Root Cause

The root cause is an off-by-one shortage in the EARLY_SEGMENT_EXTRA_PAGES allowance. The macro was not updated when the early mapper began performing an extra split for the [_text, _stext) range. As a result, page-table allocation during early boot may consume the gap page reserved before early_init_stack, causing the [data, end) segment to overflow into memory intended for other purposes.

Attack Vector

This is a kernel initialization defect triggered during boot rather than a remotely exploitable flaw. Impact depends on kernel configuration and memory layout. Overflow into the gap page can corrupt adjacent early boot structures, potentially producing unstable boot, memory corruption in init_pg_end, or interference with early_init_stack. No proof-of-concept exploit is published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests in the arm64 early kernel mapping path. Refer to the upstream fix commit for the exact code change that increases the early mapping page reserve.

Detection Methods for CVE-2026-53288

Indicators of Compromise

Unexpected boot failures or kernel panics on arm64 systems using 4K pages
Corruption or unusual contents in memory adjacent to init_pg_end or early_init_stack observed via crash dump analysis
Kernel builds that include commit 5973a62efa34 but lack the fix commits referenced in the advisory

Detection Strategies

Inventory arm64 Linux systems and verify running kernel versions against the fix commits at kernel.org
Audit kernel build configurations to identify systems compiled with CONFIG_ARM64_4K_PAGES
Review boot logs and kernel crash dumps for anomalies in early paging setup on arm64 hosts

Monitoring Recommendations

Track distribution security advisories for backported fixes to stable kernel branches
Monitor systems for repeat boot instability or unexplained early-boot panics on arm64 hardware
Correlate kernel version telemetry across the fleet to prioritize unpatched hosts

How to Mitigate CVE-2026-53288

Immediate Actions Required

Apply the upstream kernel fix commits referenced in the NVD entry as soon as vendor packages become available
Prioritize arm64 systems configured with 4K pages for patch deployment
Test patched kernels on representative hardware before broad rollout, since the fix affects early boot paging

Patch Information

Upstream fixes are available in the following stable-tree commits: 4d8e74ad4585, 9fe9e3acaa14, a4ff33053da0, and dcb89deed40b. Apply the fix appropriate to the stable branch in use or upgrade to a distribution kernel that includes it.

Workarounds

No documented runtime workaround exists; the defect is in early boot mapping logic and must be resolved via a kernel update
Where feasible, deploy kernels built with 64K pages on arm64, as the additional page reserve issue is specific to the 4K-page configuration
Delay adoption of kernels that include commit 5973a62efa34 without the corresponding fix on arm64 4K-page builds

bash

# Verify running kernel version and architecture on arm64 hosts
uname -srm

# Confirm page size configuration in the running kernel
getconf PAGE_SIZE

# Check installed kernel packages (Debian/Ubuntu)
dpkg -l | grep linux-image

# Check installed kernel packages (RHEL/Fedora)
rpm -qa | grep kernel