Medium 5.5Published Jun 26, 2026

CVE-2026-53314padata: Put CPU offline callback in ONLINE section to allow failure

Updated under an hour ago (Oct 27, 2026, 12:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: padata: Put CPU offline callback in ONLINE section to allow failure syzbot reported the following warning: DEAD callback error for CPU1 WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614 at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux") which tglx traced to padata_cpu_dead() given it's the only sub-CPUHP_TEARDOWN_CPU callback that returns an error. Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU so move the CPU offline callback to the ONLINE section where failure is possible.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	894c9ef9780c5cf2f143415e867ee39a33ecb75d builds before 65dae8b34f0810f3fa9f77c4c63650cd20820693; from 894c9ef9780c5cf2f143415e867ee39a33ecb75d before a6d44f477000c6352de6b05e9e276e62083e5fbf; 894c9ef9780c5cf2f143415e867ee39a33ecb75d builds before 3e6c08dd97dcd22a00aee469e0adfa819071d80e; 894c9ef9780c5cf2f143415e867ee39a33ecb75d builds before 5a9f29a3e076b637d2234093e57989cf755ded5b; 894c9ef9780c5cf2f143415e867ee39a33ecb75d builds before 9afe53f14a2aae8c4beb30e5ea51641a34f1a3d3; from 894c9ef9780c5cf2f143415e867ee39a33ecb75d before c8c4a2972f83c8b68ff03b43cecdb898939ff851; 2b1207801c393a5e9af2fbac2dd8b0377d8ae63a; 0685dfa0a2ff7635c0b64f7b7f0fafbf1c3e0c14; and 4 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.19.202 before 4.20; from 5.4.22 before 5.5; from 5.5.6 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/65dae8b34f0810f3fa9f77c4c63650cd20820693	patch
https://git.kernel.org/stable/c/a6d44f477000c6352de6b05e9e276e62083e5fbf	patch
https://git.kernel.org/stable/c/3e6c08dd97dcd22a00aee469e0adfa819071d80e	patch
https://git.kernel.org/stable/c/5a9f29a3e076b637d2234093e57989cf755ded5b	patch
https://git.kernel.org/stable/c/9afe53f14a2aae8c4beb30e5ea51641a34f1a3d3	patch
https://git.kernel.org/stable/c/c8c4a2972f83c8b68ff03b43cecdb898939ff851	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.