{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53180", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.390Z", "datePublished": "2026-06-25T08:38:55.332Z", "dateUpdated": "2026-06-28T06:39:54.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-28T06:39:54.094Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimers/migration: Fix livelock in tmigr_handle_remote_up()\n\ntmigr_handle_remote_cpu() skips timer_expire_remote() when cpu ==\nsmp_processor_id(), assuming the local softirq path already handled this\nCPU's timers.\n\nThis assumption is wrong because jiffies can advance after the handling of\nthe CPU's global timers in run_timer_base(BASE_GLOBAL) and before\ntmigr_handle_remote() evaluates the expiry times.\n\nAs a consequence a timer which expires after the CPU local timer wheel\nadvanced and becomes expired in the remote handling is ignored and the\ncallback is never invoked and removed from the timer wheel.\n\nWhat's worse is that fetch_next_timer_interrupt_remote() keeps reporting it\nas expired, and the event is re-queued with expires == now on each\niteration. The goto-again loop spins indefinitely.\n\nFix this by calling timer_expire_remote() unconditionally. That's minimal\noverhead for the common case as __run_timer_base() returns immediately if\nthere is nothing to expire in the local wheel.\n\n[ tglx: Amend change log and add a comment ]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timer_migration.c"], "versions": [{"version": "7ee988770326fca440472200c3eb58935fe712f6", "lessThan": "07b3b83587fb3012619f4439389b64a955fc7836", "status": "affected", "versionType": "git"}, {"version": "7ee988770326fca440472200c3eb58935fe712f6", "lessThan": "1d6c2062b77be09ec15d6bf637b2e2221c4482fc", "status": "affected", "versionType": "git"}, {"version": "7ee988770326fca440472200c3eb58935fe712f6", "lessThan": "d338e61ea94052a786aac9f58e9f0d8520afa0fd", "status": "affected", "versionType": "git"}, {"version": "7ee988770326fca440472200c3eb58935fe712f6", "lessThan": "d486b4934a8e504376b85cdb3766f306d57aff5b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timer_migration.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/07b3b83587fb3012619f4439389b64a955fc7836"}, {"url": "https://git.kernel.org/stable/c/1d6c2062b77be09ec15d6bf637b2e2221c4482fc"}, {"url": "https://git.kernel.org/stable/c/d338e61ea94052a786aac9f58e9f0d8520afa0fd"}, {"url": "https://git.kernel.org/stable/c/d486b4934a8e504376b85cdb3766f306d57aff5b"}], "title": "timers/migration: Fix livelock in tmigr_handle_remote_up()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: timers/migration: Fix livelock in tmigr_handle_remote_up()", "id": "2492772", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492772"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in the Linux kernel's timer migration handling. An incorrect assumption in the `tmigr_handle_remote_cpu()` function regarding local softirq path handling of CPU timers can lead to a livelock. This occurs when a timer expires after the local timer wheel advances but before remote handling evaluates expiry times, causing the timer to be ignored and repeatedly re-queued. This can result in an indefinite loop, leading to a Denial of Service (DoS) condition."], "name": "CVE-2026-53180", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53180\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53180\nhttps://lore.kernel.org/linux-cve-announce/2026062554-CVE-2026-53180-802a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ee988770326fca440472200c3eb58935fe712f6,07b3b83587fb3012619f4439389b64a955fc7836)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ee988770326fca440472200c3eb58935fe712f6,1d6c2062b77be09ec15d6bf637b2e2221c4482fc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ee988770326fca440472200c3eb58935fe712f6,d338e61ea94052a786aac9f58e9f0d8520afa0fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ee988770326fca440472200c3eb58935fe712f6,d486b4934a8e504376b85cdb3766f306d57aff5b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T12:00:14.032586+00:00", "updated": "2026-06-28T14:30:07.099876+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}