Junglewise Threat Intelligence

CVE-2026-53314: Linux Kernel padata incorrect CPU hotplug callback placement

CVE-2026-53314 · Severity: info · Published 2026-06-26

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's padata framework, which is responsible for managing parallelized data processing. The issue involves how the system handles a processor (CPU) being taken offline; specifically, it could trigger a kernel warning or instability because the system was not prepared to handle a failure during this specific shutdown phase. While primarily a stability issue, it could lead to unexpected system behavior or crashes during hardware reconfiguration or power management tasks.

Technical details

This vulnerability stems from the placement of the padata_cpu_dead() callback within the CPU hotplug state machine. In the Linux kernel, failure is not permitted in hotplug states occurring before CPUHP_TEARDOWN_CPU. Because padata_cpu_dead() could return an error (specifically when validating cpumasks during a CPU offline event), it triggered a 'DEAD callback error' warning in kernel/cpu.c. The fix involves moving the CPU offline callback to the ONLINE section of the hotplug state machine, where failures are explicitly permitted and handled. This ensures that if a CPU mask validation fails during the offlining process, the kernel can respond appropriately rather than triggering a warning or entering an inconsistent state.

Affected products

  • Linux Linux Kernel 4.19.202 to 4.20, 5.4.22 to 5.5, 5.5.6 to 5.6, and versions prior to 6.13.y/7.0.y (see git commits for specific stable branches)

Timeline

  • 2026-03-13: disclosed: Initial patch authored by Daniel Jordan
  • 2026-05-23: patched: Patch committed to stable trees by Greg Kroah-Hartman
  • 2026-06-26: advisory: CVE-2026-53314 published

References

Related threats