Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53059— dm log: fix out-of-bounds write due to region_count overflow

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 2.6.12版本存在安全漏洞，该漏洞源于create_log_context()函数中region_count变量声明为32位无符号整数但除数返回64位值，可能导致整数溢出，进而导致越界写入内核堆内存。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.14% · P3

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 44ab8875ae4a2842bde2d756bed195d375e0debb affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< defe483e47173768c227532694dc78cb65db5f09 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3ec74da927b4e171a6fc0e77b1188ba4d019af51 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d4ac87567f86a55c3c92e9a5144dcd943a9772a1 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 12bd5b88e91a02785244ff1d20fb157e96e9cdc8 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b455903eed4558982be0811f5b7f44f6bbc4ff57 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4ec8323b9f0764a14d532b1ae9b87f8a9fecb867 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c20e36b7631d83e7535877f08af8b0af72c44b1a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53059

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
dm log: fix out-of-bounds write due to region_count overflow
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 2.6.12版本存在安全漏洞，该漏洞源于create_log_context()函数中region_count变量声明为32位无符号整数但除数返回64位值，可能导致整数溢出，进而导致越界写入内核堆内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 44ab8875ae4a2842bde2d756bed195d375e0debb -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-53059

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53059

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53059 (8)

Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total

CVE-2026-53049 9.8 CRITICAL gfs2: add some missing log locking
CVE-2026-52993 9.8 CRITICAL tipc: fix double-free in tipc_buf_append()
CVE-2026-52989 9.8 CRITICAL nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
CVE-2026-52986 9.8 CRITICAL netfilter: nf_conntrack_sip: don't use simple_strtoul
CVE-2026-52982 9.8 CRITICAL net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
CVE-2026-53002 9.8 CRITICAL netfilter: conntrack: remove sprintf usage
CVE-2026-53086 9.8 CRITICAL net: bcmgenet: fix racing timeout handler
CVE-2026-53045 9.8 CRITICAL memory: tegra124-emc: Fix dll_change check
CVE-2026-53006 9.8 CRITICAL ipv6: fix possible UAF in icmpv6_rcv()
CVE-2026-53046 9.8 CRITICAL ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
CVE-2026-52955 9.8 CRITICAL libceph: Fix potential out-of-bounds access in crush_decode()
CVE-2026-53010 9.8 CRITICAL ksmbd: fix use-after-free in smb2_open during durable reconnect
CVE-2026-53088 9.8 CRITICAL net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
CVE-2026-52924 9.8 CRITICAL sctp: purge outqueue on stale COOKIE-ECHO handling
CVE-2026-52931 9.8 CRITICAL batman-adv: tp_meter: avoid use of uninit sender vars
CVE-2026-53055 9.8 CRITICAL crypto: hisilicon/sec2 - prevent req used-after-free for sec
CVE-2026-52914 9.8 CRITICAL batman-adv: fix fragment reassembly length accounting
CVE-2026-52958 9.1 CRITICAL libceph: Fix potential out-of-bounds access in osdmap_decode()
CVE-2026-53043 9.1 CRITICAL ocfs2/dlm: validate qr_numregions in dlm_match_regions()
CVE-2026-52999 9.1 CRITICAL netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Showing top 20 of 219 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53059

No comments yet

Leave a comment