CVE-2026-53047 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux kernel versions 4.14.13 to 7.0.10, 4.15, and 6.12.91 or earlier should be aware of this vulnerability and take necessary actions to assess and mitigate potential risks.

Technical summary

The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t). This inconsistent allocation might lead to a heap buffer overflow when storing physical addresses on 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit. The vulnerability affects Linux kernel versions 4.14.13 to 7.0.10, 4.15, and 6.12.91 or earlier.

Defensive priority

Medium priority due to potential for heap buffer overflow and the wide range of affected systems.

Recommended defensive actions

• Review and apply patches provided by Linux kernel maintainers.
• Inventory Linux kernel versions and assess vulnerability.
• Monitor Linux kernel updates and apply patches promptly.
• Consider implementing compensating controls, such as memory protection mechanisms.
• Perform vulnerability assessment and prioritize patching based on exposure.
• Track patch deployment and verify successful application.
• Review system logs for indicators of potential exploitation.

Evidence notes

The CVE record was published on 2026-06-24T17:17:16.533Z and last modified on 2026-07-21T17:22:44.967Z. The NVD entry is currently Analyzed. This vulnerability affects Linux kernel versions 4.14.13 to 7.0.10, 4.15, and 6.12.91 or earlier. The efi/capsule-loader vulnerability might cause an undersized allocation, potentially leading to a heap buffer overflow when storing physical addresses on 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit. The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.