PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53189 Linux CVE debrief

A HIGH severity vulnerability, CVE-2026-53189, with a CVSS score of 7.8, has been resolved in the Linux kernel. The issue involves updating the file PMD counter before folio_put() in __split_huge_pmd_locked(). If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). The counter update has been moved before folio_put() to address this vulnerability. This change ensures that the file/shmem RSS counter is updated before the PMD mapping's folio reference is dropped. The vulnerability affects the Linux kernel, and defenders should review their systems for exposure. The CVE record and NVD detail provide further information on this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-07-06
Advisory published
2026-06-25
Advisory updated
2026-07-06

Who should care

Defenders responsible for Linux kernel-based systems should review their systems for exposure to CVE-2026-53189. The vulnerability has a HIGH severity score of 7.8 and affects the Linux kernel. Reviewing the CVE record and NVD detail can provide further information on this vulnerability.

Technical summary

The vulnerability, CVE-2026-53189, is related to the Linux kernel's handling of huge memory. Specifically, __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. This can lead to mm_counter_file() reading freed folio state via folio_test_swapbacked() if folio_put() drops the last reference. To address this, the counter update has been moved before folio_put(). This change ensures that the file/shmem RSS counter is updated before the PMD mapping's folio reference is dropped.

Defensive priority

Defenders should prioritize reviewing their Linux kernel-based systems for exposure to CVE-2026-53189. The vulnerability has a HIGH severity score of 7.8 and affects the Linux kernel.

Recommended defensive actions

  • Review Linux kernel-based systems for exposure to CVE-2026-53189
  • Update to the latest Linux kernel version that includes the fix
  • Monitor system logs for potential exploitation attempts
  • Implement compensating controls to mitigate potential impact
  • Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD detail provide further information on this vulnerability. The vulnerability has been resolved by updating the file PMD counter before folio_put() in __split_huge_pmd_locked(). The change ensures that the file/shmem RSS counter is updated before the PMD mapping's folio reference is dropped.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53189 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53189

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53189 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53189

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.