CVE-2026-53243: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
In the Linux kernel, the following vulnerability has been resolved:
rseq: Fix using an uninitialized stack variable in rseqexituserupdate()
There is an bug in which an uninitialized stack variable is used in rseqexituserupdate() as reported by syzbot:
BUG: KMSAN: kernel-infoleak in rseqsetidsgetcsaddr include/linux/rseqentry.h:502 [inline]
The local variable:
struct rseqids ids = { .cpuid = taskcpu(t), .mmcid = taskmmcid(t), .nodeid = cputonode(ids.cpuid), };
According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates cputonode(ids.cpuid) before ids.cpuid is initialized with taskcpu(t).
This is fixed by moving the assignment of ids.nodeid outside the structure initialization.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53243?
The severity of CVE-2026-53243 is rated at 15.
What type of vulnerability is CVE-2026-53243?
CVE-2026-53243 is categorized as an Infoleak vulnerability.
How do I fix CVE-2026-53243?
To fix CVE-2026-53243, ensure you update to the latest version of the Linux kernel where the fix has been implemented.
What specific function is affected by CVE-2026-53243?
The function affected by CVE-2026-53243 is rseq_exit_user_update().
When was CVE-2026-53243 published?
CVE-2026-53243 was published on June 25, 2026.