Executive brief
A technical flaw was identified in the Linux kernel's Restartable Sequences (rseq) subsystem, which is used to optimize certain multi-threaded operations. Due to a coding error, the system could inadvertently use uninitialized data when updating user-space information. While primarily a technical bug, such issues can sometimes lead to minor leaks of internal system information to local users.
Technical details
A vulnerability exists in the Linux kernel's rseq (Restartable Sequences) implementation within `include/linux/rseq_entry.h`. The function `rseq_exit_user_update()` used a struct initializer list where one member (`node_id`) was initialized using another member (`cpu_id`) from the same struct. Because the C standard specifies that the evaluation order of expressions in an initializer list is indeterminate, certain compilers (like Clang) may evaluate the dependent expression before the source field is initialized. This results in the use of an uninitialized stack variable, leading to a potential kernel-infoleak as detected by KMSAN. The issue has been resolved by ensuring variables are properly initialized before use.
Affected products
- Linux Linux Kernel 7.0.10 to 7.0.13
Timeline
- 2026-06-02: disclosed: Initial patch submitted by Qing Wang
- 2026-06-25: advisory: CVE-2026-53243 published by NVD