CVE-2026-53326 Overview
CVE-2026-53326 addresses a locking flaw in the Linux kernel's debugobjects subsystem. The issue surfaces during early boot on debug PREEMPT_RT kernels running on ARM64 systems. Lockdep reports an inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage warning when an interrupt fires before SYSTEM_SCHEDULING is set and the hardirq handler attempts to call fill_pool(). The upstream fix introduces a can_fill_pool() helper and reorders the exception rule to forbid pool allocations from hard interrupt context.
Critical Impact
The flaw can cause a deadlock during early boot when a hardirq handler attempts a debug object pool allocation while holding a lock required by the allocation path.
Affected Products
- Linux kernel builds with CONFIG_DEBUG_OBJECTS and CONFIG_PREEMPT_RT enabled
- ARM64 systems booting debug PREEMPT_RT kernels
- Stable kernel trees receiving the debugobjects backport commits
Discovery Timeline
- 2026-07-01 - CVE-2026-53326 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-53326
Vulnerability Analysis
The debugobjects infrastructure tracks the lifecycle of kernel objects and requires a preallocated pool of tracking descriptors. When the pool is depleted, fill_pool() allocates new entries through the slab allocator. On a PREEMPT_RT kernel, the allocator internally relies on sleeping locks that cannot be acquired from hard interrupt context.
During early boot, the kernel enables interrupts before the scheduler is available. In that window, SYSTEM_SCHEDULING is not yet set and a hardirq can preempt a code path that already holds an allocator-related lock. If the interrupt handler then invokes fill_pool(), the kernel attempts to reacquire the same lock, producing the lockdep warning and, on real hardware, a deadlock.
Root Cause
The exception logic in fill_pool() permitted allocations during early boot without excluding the hard interrupt context case. On PREEMPT_RT, the allocator's locks are sleeping locks, so calling into the allocator from hardirq context violates the locking rules of the subsystem [CWE-667 category].
Attack Vector
This is a locally reachable stability defect, not a remotely exploitable memory-safety bug. The condition arises deterministically from the kernel's own boot sequence on affected configurations. No attacker-supplied input is required, and the CVE record does not describe a path to privilege escalation or code execution. The practical impact is a boot-time hang or lockdep splat on debug kernels.
The fix, applied across commits 0d046ae1, 44b8b03a, and 7bc71bdb, adds a can_fill_pool() predicate that returns false when the caller runs in hard interrupt context, and reorders the early-boot exception so it no longer overrides that check. See the Kernel Git Commit 0d046ae for the reference change.
Detection Methods for CVE-2026-53326
Indicators of Compromise
- Lockdep warning inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage in the kernel log during early boot
- Boot hangs or watchdog resets on ARM64 systems running debug PREEMPT_RT kernels
- Stack traces referencing fill_pool, debug_objects, and interrupt entry paths
Detection Strategies
- Inventory kernel builds across the fleet and identify those compiled with CONFIG_DEBUG_OBJECTS=y and CONFIG_PREEMPT_RT=y.
- Parse dmesg and serial console captures for the specific lockdep signature associated with debugobjects during boot.
- Compare running kernel versions against the fixed commit hashes in the stable trees to confirm patch presence.
Monitoring Recommendations
- Forward kernel ring buffer and serial console logs from ARM64 hosts to a centralized log platform for correlation.
- Alert on any lockdep or BUG: messages emitted before systemd reaches its default target.
- Track kernel package versions in configuration management to detect regressions to unpatched builds.
How to Mitigate CVE-2026-53326
Immediate Actions Required
- Update to a Linux kernel that includes commits 0d046ae1, 44b8b03a, or 7bc71bdb in your stable tree.
- Prioritize patching on ARM64 hosts running realtime workloads with PREEMPT_RT and debug options enabled.
- Rebuild any out-of-tree modules against the patched kernel headers before redeployment.
Patch Information
The fix is available upstream through three commits: Kernel Git Commit 0d046ae, Kernel Git Commit 44b8b03, and Kernel Git Commit 7bc71bd. Apply the stable kernel update from your distribution once it lands in the release channel.
Workarounds
- Disable CONFIG_DEBUG_OBJECTS in production kernel builds where debug tracking is not required.
- Avoid running PREEMPT_RT debug builds on ARM64 hardware until the patched kernel is deployed.
- Where debug builds are mandatory for development, restrict use to lab systems where a boot-time hang is tolerable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
