High7.8Red Hat Linux

High [CVE-2026-53359] Fix shadow paging use-after-free due to unexpected role

This high-severity Red Hat Linux advisory covers CVE-2026-53359 affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 1.

CVE-2026-53359 Published Jul 4, 2026Updated by vendor Jul 4, 2026

CVE-2026-53359

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Fix shadow paging use-after-free due to unexpected role. Red Hat rates this important (CVSS 7.8).

Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:36957 with package rhcos-4.22.9.8.202607152026-0, kernel-0:5.14.0-570.127.1.el9_6, kernel-0:4.18.0-477.154.1.el8_8, kernel-0:5.14.0-427.137.1.el9_4.

Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1.

Affected versions

kernel-0:6.12.0-211.32.1.el10_2
kernel-0:5.14.0-687.24.1.el9_8

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

rhcos-4.22.9.8.202607152026-0
kernel-0:5.14.0-570.127.1.el9_6
kernel-0:4.18.0-477.154.1.el8_8
kernel-0:5.14.0-427.137.1.el9_4
kernel-0:4.18.0-553.143.1.el8_10
kernel-rt-0:5.14.0-284.181.1.rt14.466.el9_2
kernel-0:5.14.0-687.24.1.el9_8
kernel-rt-0:4.18.0-553.143.1.rt7.484.el8_10
kernel-0:6.12.0-211.32.1.el10_2
kpatch-patch
rhcos-4.21.9.6.202607151836-0
rhcos-4.20.9.6.202607151937-0
kernel-0:6.12.0-55.88.1.el10_0
kernel-0:5.14.0-284.181.1.el9_2
RHSA-2026:36957

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation checklist

Recommended fix / mitigation

This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules: ``` options kvm-intel nested=0 options kvm-amd nested=0 ``` Use `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.