{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison  Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock when racing with a concurrent unmap:    thread#0                              thread#1   --------                              --------   madvise(folio, MADV_HWPOISON)     -\u003e poisons the folio successfully   madvise(folio, MADV_HWPOISON)         unmap(folio)     try_memory_failure_hugetlb       get_huge_page_for_hwpoison         spin_lock_irq(\u0026hugetlb_lock)    \u003c- held         __get_huge_page_for_hwpoison           hugetlb_update_hwpoison()             -\u003e MF_HUGETLB_FOLIO_PRE_POISONED           goto out:             folio_put()               refcount: 1 -\u003e 0               free_huge_folio()                 spin_lock_irqsave(\u0026hugetlb_lock)                   -\u003e AA DEADLOCK!  The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop the GUP reference while the hugetlb_lock is still held by the hugetlb.c wrapper get_huge_page_for_hwpoison().  If concurrent unmap has released the page table mapping reference, folio_put() drops the folio refcount to zero, triggering free_huge_folio() which attempts to re-acquire the non-recursive hugetlb_lock.  Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper into get_huge_page_for_hwpoison().  Place spin_unlock_irq() before the folio_put() at the out: label so the folio is always released outside the lock.  [akpm@linux-foundation.org: fix race, rename label per Miaohe]",
  "id": "DEBIAN-CVE-2026-53207",
  "modified": "2026-09-14T16:47:46.572036149Z",
  "published": "2026-06-25T09:16:38.233Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53207"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53207"
  ]
}