CVE-2026-53333 Overview
CVE-2026-53333 is a Linux kernel vulnerability in the memory management subsystem, specifically in the mm/mincore implementation. The mincore_swap() function processes migration entries, hardware-poisoned page entries, and shmem swapin-error entries in addition to true swap entries. On kernels built without CONFIG_SWAP but with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE enabled, the !IS_ENABLED(CONFIG_SWAP) guard executed before the non-swap-entry early return. This ordering caused mincore_pte_range() to trigger spurious WARN events and incorrectly report affected pages as nonresident.
Critical Impact
The flaw produces spurious kernel warnings and incorrect residency reporting from mincore() syscalls on specific kernel configurations, affecting reliability of memory introspection interfaces.
Affected Products
- Linux kernel builds without CONFIG_SWAP
- Linux kernel builds with CONFIG_MIGRATION enabled
- Linux kernel builds with CONFIG_MEMORY_FAILURE enabled
Discovery Timeline
- 2026-07-01 - CVE-2026-53333 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-53333
Vulnerability Analysis
The vulnerability resides in the mincore_pte_range() code path within mm/mincore.c. The mincore() system call reports whether pages of a mapped file are resident in memory. When processing page table entries, the kernel calls mincore_swap() to handle non-present entries, which can represent true swap entries, migration entries, hardware-poisoned entries, or shmem swapin-error entries.
The original implementation placed the !IS_ENABLED(CONFIG_SWAP) compile-time guard before the check for non-swap entries. On kernels compiled without swap support but with page migration or memory failure handling enabled, this ordering caused the guard to fire on legitimate non-swap entries. The result was spurious WARN splats in the kernel log and incorrect residency data returned to userspace callers.
Root Cause
The root cause is incorrect ordering of conditional checks in mincore_swap(). Migration and hwpoison entries can exist independently of swap support, but the code treated the absence of CONFIG_SWAP as sufficient reason to warn on any non-present entry. Compile-time configuration assumptions did not match runtime entry semantics.
Attack Vector
This is a kernel correctness issue rather than a directly exploitable memory-safety flaw. Unprivileged local processes calling mincore() on mappings containing migration or hwpoison entries can trigger the spurious WARN on affected kernels. Repeated triggering can flood kernel logs and produce misleading residency reports for tooling that relies on mincore(). The fix moves the swap-config guard below the non-swap-entry check so only true swap entries reach the WARN, while migration and hwpoison entries follow the existing uptodate/non-shmem path.
Detection Methods for CVE-2026-53333
Indicators of Compromise
- Unexpected WARN splats referencing mincore_pte_range or mincore_swap in dmesg output on kernels without CONFIG_SWAP.
- Userspace applications reporting inconsistent residency results from the mincore() syscall on files under memory pressure or migration.
- Elevated kernel log volume tied to processes invoking mincore() on mappings with migrated or poisoned pages.
Detection Strategies
- Audit running kernel configurations for CONFIG_SWAP=n combined with CONFIG_MIGRATION=y or CONFIG_MEMORY_FAILURE=y.
- Parse kernel ring buffer logs for WARN_ON traces originating in mm/mincore.c.
- Correlate application-level anomalies in memory residency queries with kernel warning timestamps.
Monitoring Recommendations
- Forward dmesg and journald kernel-facility logs to a centralized log store for stack-trace pattern matching.
- Baseline the frequency of kernel WARN events per host and alert on statistically significant increases.
- Track kernel package versions across the fleet to identify hosts still running pre-patch builds.
How to Mitigate CVE-2026-53333
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the upstream fix commits.
- Prioritize patching on systems built with CONFIG_SWAP disabled and CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE enabled.
- Rebuild custom kernels from sources that incorporate the corrected mincore_swap() guard ordering.
Patch Information
The fix reorders the checks in mincore_swap() so the non-swap-entry early return runs before the !IS_ENABLED(CONFIG_SWAP) guard. Migration and hwpoison entries follow the existing uptodate/non-shmem path, and only true swap entries reach the WARN. Patch details are available in the upstream stable kernel commits: Kernel Update Commit 0c25b873, Kernel Update Commit 3481d437, and Kernel Update Commit a8f91ddf.
Workarounds
- Enable CONFIG_SWAP in kernel builds where feasible to avoid the affected code path.
- Restrict untrusted local workloads that heavily invoke mincore() on affected kernels until patching completes.
- Suppress noisy kernel logging temporarily via rate limiting while planning kernel updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
