CVE-2026-53062 (GCVE-0-2026-53062)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
Title
dm cache policy smq: fix missing locks in invalidating cache blocks
Summary
In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up with data races on the allocated blocks counter, or even use-after-free issues with internal data structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't affect passthrough mode since migration tasks don't exist there, but would need attention if supporting fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache device consisting of 1024 cache entries dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Populate the cache, and record the number of cached blocks fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the passthrough cache. By setting multiple jobs with I/O size equal to the cache block size, cache blocks are invalidated concurrently from different workers. fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \ --direct=1 --numjobs=2 --randrepeat=0 --size=64m 5. Check if demoted matches cached block count. These numbers should match but may differ due to the data race. nr_demoted=$(dmsetup status cache | awk '{print $12}') echo "$nr_cached, $nr_demoted"
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 4991b5a08751e2e82488fb93ae08849b6aea10d9 (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513 (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < ac5ee99443891bdb161f5539606a66a1b5e72542 (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 93627a29d4b66d4a2def938dfb8610cc80ae454b (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < c348ae47d8e65f06429fa41adce9ad986b696766 (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 2b62d0611c9af14a16bddf22df2612b4f40eb5a1 (git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45 (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-cache-policy-smq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4991b5a08751e2e82488fb93ae08849b6aea10d9",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "1b2bec4a7dcf5f00b7a1cbeeec8997841d783513",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "ac5ee99443891bdb161f5539606a66a1b5e72542",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "93627a29d4b66d4a2def938dfb8610cc80ae454b",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "c348ae47d8e65f06429fa41adce9ad986b696766",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "2b62d0611c9af14a16bddf22df2612b4f40eb5a1",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            },
            {
              "lessThan": "2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45",
              "status": "affected",
              "version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-cache-policy-smq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache policy smq: fix missing locks in invalidating cache blocks\n\nIn passthrough mode, the policy invalidate_mapping operation is called\nsimultaneously from multiple workers, thus it should be protected by a\nlock. Otherwise, we might end up with data races on the allocated blocks\ncounter, or even use-after-free issues with internal data structures\nwhen doing concurrent writes.\n\nNote that the existing FIXME in smq_invalidate_mapping() doesn\u0027t affect\npassthrough mode since migration tasks don\u0027t exist there, but would need\nattention if supporting fast device shrinking via suspend/resume without\ntarget reloading.\n\nReproduce steps:\n\n1. Create a cache device consisting of 1024 cache entries\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. Populate the cache, and record the number of cached blocks\n\nfio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \\\n--size=64m --direct=1\nnr_cached=$(dmsetup status cache | awk \u0027{split($7, a, \"/\"); print a[1]}\u0027)\n\n3. Reload the cache into passthrough mode\n\ndmsetup suspend cache\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\ndmsetup resume cache\n\n4. Write to the passthrough cache. By setting multiple jobs with I/O\n   size equal to the cache block size, cache blocks are invalidated\n   concurrently from different workers.\n\nfio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \\\n--direct=1 --numjobs=2 --randrepeat=0 --size=64m\n\n5. Check if demoted matches cached block count. These numbers should\n   match but may differ due to the data race.\n\nnr_demoted=$(dmsetup status cache | awk \u0027{print $12}\u0027)\necho \"$nr_cached, $nr_demoted\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local block I/O to an existing dm-cache mapped device, such as writes from a mounted filesystem or direct writes to the block device. It is not reachable through a network packet path.\nAC:L - Once the dm-cache target is in passthrough mode with clean cached mappings, the attacker can trigger the race by issuing concurrent writes and controls both racing sides. No uncontrollable timing condition beyond ordinary concurrent I/O is required.\nPR:L - Creating or reloading the dm-cache target requires CAP_SYS_ADMIN, but in a reasonable deployed scenario an unprivileged local user with write access to a filesystem backed by the existing target can submit the writes that reach the vulnerable code. Device-mapper control ioctls are not reachable through unprivileged user namespaces.\nUI:N - The attacker only needs to issue local writes; no separate victim action is required.\nS:U - The corruption occurs inside the same kernel and block-device security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The missing locking can produce use-after-free style reuse and corruption of SMQ internal mapping structures. Following the higher-severity rule for kernel memory corruption, this is treated as capable of enabling high-impact information disclosure.\nI:H - The race can corrupt cache policy queues/hash tables and freed/reused mapping entries, affecting kernel control/data structures and potentially cache block mapping integrity. This is memory corruption/use-after-free class behavior, so high integrity impact is defensible.\nA:H - The race can trigger double-free/allocation checks, corrupted queues/hash state, NULL-deref-adjacent failures in the same passthrough write path, or kernel oops/panic. Repeated concurrent writes can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:01.533Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4991b5a08751e2e82488fb93ae08849b6aea10d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b2bec4a7dcf5f00b7a1cbeeec8997841d783513"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5ee99443891bdb161f5539606a66a1b5e72542"
        },
        {
          "url": "https://git.kernel.org/stable/c/93627a29d4b66d4a2def938dfb8610cc80ae454b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c348ae47d8e65f06429fa41adce9ad986b696766"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b62d0611c9af14a16bddf22df2612b4f40eb5a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45"
        }
      ],
      "title": "dm cache policy smq: fix missing locks in invalidating cache blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53062",
    "datePublished": "2026-06-24T16:30:06.189Z",
    "dateReserved": "2026-06-09T07:44:35.382Z",
    "dateUpdated": "2026-08-05T12:33:01.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53062",
      "date": "2026-08-06",
      "epss": "0.00097",
      "percentile": "0.00862"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:41:52.000Z",
      "cve": "CVE-2026-53062",
      "id": "msrc_CVE-2026-53062",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dm cache policy smq: fix missing locks in invalidating cache blocks",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53062.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53062\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:19.030\",\"lastModified\":\"2026-07-21T17:36:16.187\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm cache policy smq: fix missing locks in invalidating cache blocks\\n\\nIn passthrough mode, the policy invalidate_mapping operation is called\\nsimultaneously from multiple workers, thus it should be protected by a\\nlock. Otherwise, we might end up with data races on the allocated blocks\\ncounter, or even use-after-free issues with internal data structures\\nwhen doing concurrent writes.\\n\\nNote that the existing FIXME in smq_invalidate_mapping() doesn\u0027t affect\\npassthrough mode since migration tasks don\u0027t exist there, but would need\\nattention if supporting fast device shrinking via suspend/resume without\\ntarget reloading.\\n\\nReproduce steps:\\n\\n1. Create a cache device consisting of 1024 cache entries\\n\\ndmsetup create cmeta --table \\\"0 8192 linear /dev/sdc 0\\\"\\ndmsetup create cdata --table \\\"0 131072 linear /dev/sdc 8192\\\"\\ndmsetup create corig --table \\\"0 262144 linear /dev/sdc 262144\\\"\\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\\ndmsetup create cache --table \\\"0 262144 cache /dev/mapper/cmeta \\\\\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\\\"\\n\\n2. Populate the cache, and record the number of cached blocks\\n\\nfio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \\\\\\n--size=64m --direct=1\\nnr_cached=$(dmsetup status cache | awk \u0027{split($7, a, \\\"/\\\"); print a[1]}\u0027)\\n\\n3. Reload the cache into passthrough mode\\n\\ndmsetup suspend cache\\ndmsetup reload cache --table \\\"0 262144 cache /dev/mapper/cmeta \\\\\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\\\"\\ndmsetup resume cache\\n\\n4. Write to the passthrough cache. By setting multiple jobs with I/O\\n   size equal to the cache block size, cache blocks are invalidated\\n   concurrently from different workers.\\n\\nfio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \\\\\\n--direct=1 --numjobs=2 --randrepeat=0 --size=64m\\n\\n5. Check if demoted matches cached block count. These numbers should\\n   match but may differ due to the data race.\\n\\nnr_demoted=$(dmsetup status cache | awk \u0027{print $12}\u0027)\\necho \\\"$nr_cached, $nr_demoted\\\"\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-cache-policy-smq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"4991b5a08751e2e82488fb93ae08849b6aea10d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"1b2bec4a7dcf5f00b7a1cbeeec8997841d783513\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"ac5ee99443891bdb161f5539606a66a1b5e72542\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"93627a29d4b66d4a2def938dfb8610cc80ae454b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"c348ae47d8e65f06429fa41adce9ad986b696766\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"2b62d0611c9af14a16bddf22df2612b4f40eb5a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b29d4986d0da1a27cd35917cdb433672f5c95d7f\",\"lessThan\":\"2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-cache-policy-smq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.12\",\"versionEndExcluding\":\"5.10.258\",\"matchCriteriaId\":\"7FED9066-C252-4AA0-A5D6-7FDDC40E11A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"919C10A9-7951-4A74-BADD-C135A0A8D8B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b2bec4a7dcf5f00b7a1cbeeec8997841d783513\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b62d0611c9af14a16bddf22df2612b4f40eb5a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4991b5a08751e2e82488fb93ae08849b6aea10d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93627a29d4b66d4a2def938dfb8610cc80ae454b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac5ee99443891bdb161f5539606a66a1b5e72542\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c348ae47d8e65f06429fa41adce9ad986b696766\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:30+00:00",
      "cve": "CVE-2026-53062",
      "id": "CVE-2026-53062",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm cache policy smq: fix missing locks in invalidating cache blocks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53062.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T23:36:31Z",
      "cve": "CVE-2026-53062",
      "id": "CVE-2026-53062",
      "initial_release_date": "2026-07-01T03:19:23Z",
      "product_status:known_affected": "289",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53062",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53062.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.