CVE-2026-53207

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can

trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock

when racing with a concurrent unmap:

thread#0 thread#1

-------- --------

madvise(folio, MADV_HWPOISON)

-> poisons the folio successfully

madvise(folio, MADV_HWPOISON) unmap(folio)

try_memory_failure_hugetlb

get_huge_page_for_hwpoison

spin_lock_irq(&hugetlb_lock) <- held

__get_huge_page_for_hwpoison

hugetlb_update_hwpoison()

-> MF_HUGETLB_FOLIO_PRE_POISONED

goto out:

folio_put()

refcount: 1 -> 0

free_huge_folio()

spin_lock_irqsave(&hugetlb_lock)

-> AA DEADLOCK!

The out: path in __get_hug

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References