CVE-2026-53314: padata: Put CPU offline callback in ONLINE section to allow failure
In the Linux kernel, the following vulnerability has been resolved:
padata: Put CPU offline callback in ONLINE section to allow failure
syzbot reported the following warning:
DEAD callback error for CPU1 WARNING: kernel/cpu.c:1463 at cpudown+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux") which tglx traced to padatacpudead() given it's the only sub-CPUHPTEARDOWNCPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHPTEARDOWNCPU so move the CPU offline callback to the ONLINE section where failure is possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 4ae12d8bd9a8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53314?
The severity of CVE-2026-53314 is rated at 27.
How do I fix CVE-2026-53314?
To fix CVE-2026-53314, ensure that you update to the latest patched version of the Linux kernel.
What impact does CVE-2026-53314 have on Linux kernel users?
CVE-2026-53314 may lead to callbacks failing when taking CPUs offline, potentially affecting system stability.
Is CVE-2026-53314 a remote exploit vulnerability?
CVE-2026-53314 is not classified as a remote exploit vulnerability, as it primarily involves local CPU management.
What was the nature of the warning reported regarding CVE-2026-53314?
The warning reported for CVE-2026-53314 indicated a DEAD callback error when attempting to take a CPU offline.