Out-of-bounds read in Linux kernel - CVE-2026-53217
Published: June 26, 2026
Vulnerability identifier: #VU135563
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-53217
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local attacker to disclose sensitive information.
The vulnerability exists due to improper memory synchronization in mvpp2_rx() in the mvpp2 network driver when processing received packets on non-coherent DMA systems. A local attacker can send network traffic that triggers reception of a crafted frame to disclose sensitive information.
Only non-coherent DMA systems are affected.
How to mitigate CVE-2026-53217
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/180235600934bef6add3be637c296d6cf3272e67
- https://git.kernel.org/stable/c/19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8
- https://git.kernel.org/stable/c/23548007b3c66d628fc7d6b80d1e23be04ea10d9
- https://git.kernel.org/stable/c/60412bdd1b2576659eac23a23d2d9ff96228a643
- https://git.kernel.org/stable/c/a13199fa224e9f776f4005d5037df03aa9ea8f37
- https://git.kernel.org/stable/c/a3ad9b5767c89531fc7dae951b51b0933dcf7051
- https://git.kernel.org/stable/c/bede0f481b9137d73d1cf64309cbe4b94818a5d6
- https://git.kernel.org/stable/c/e302206ad84a407a7e5f3f6fe767ff5efaace689