Medium 5.5Published Jul 1, 2026

CVE-2026-53326debugobjects: Don't call fill_pool() in early boot hardirq context

Updated under an hour ago (Oct 26, 2026, 5:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't call fill_pool() in early boot hardirq context When booting a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage" lockdep warning message was reported to the console. During early boot, interrupts are enabled before the scheduler is enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard interrupt context handler attempt to fill the pool This can lead to a deadlock when the interrupt occurred when the interrupt hits a region which holds a lock that is required to be taken in the allocation path. Add a new can_fill_pool() helper and reorder the exception rule and forbid this scenario by excluding allocations from hard interrupt context.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	13abb2b11ac3b6cb89822f152e770081893e4bc3 builds before 3cc90ea0dd0fb1f8db577dcdc027fc46c06049f6; from 0d2a64411b0974a469ff56e62441055147e5a194 before 5d95f6b267f3d7fe54f42a3b224bb4a3d3990b41; from c93859a52b0d6953cdaa17fd7fb46a6871b015cf before 27335c50014102e9077b784ebd314954286afcab; from a460935022f512e167b4c5d4c12d85f89ba6aabd before 44b8b03a9fb5c575548fc72c674653d6baba142a; from 06e0ae988f6e3499785c407429953ade19c1096b before 7bc71bdb1c1526c7f02a6adab324394ff1327b0a; 06e0ae988f6e3499785c407429953ade19c1096b builds before 0d046ae106255cba5eb83b23f78ee93f3620247d	CNA record
linux linux_kernel linux:linux_kernel	from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/3cc90ea0dd0fb1f8db577dcdc027fc46c06049f6	patch
https://git.kernel.org/stable/c/5d95f6b267f3d7fe54f42a3b224bb4a3d3990b41	patch
https://git.kernel.org/stable/c/27335c50014102e9077b784ebd314954286afcab	patch
https://git.kernel.org/stable/c/44b8b03a9fb5c575548fc72c674653d6baba142a	patch
https://git.kernel.org/stable/c/7bc71bdb1c1526c7f02a6adab324394ff1327b0a	patch
https://git.kernel.org/stable/c/0d046ae106255cba5eb83b23f78ee93f3620247d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.