Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-53312 is a medium-severity Infinite Loop (CWE-835) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39847
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Remove overflows on the invalidation path Since RISC-V supports a sign extended page table it should support a gather->end of ULONG_MAX, but if this happens it will infinite loop…
more
because of the overflow. Also avoid overflow computing the length by moving the +1 to the other side of the <
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in kernel IOMMU invalidation leads to infinite loop, enabling DoS via system exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Rigorous developer testing of edge cases (ULONG_MAX end addresses, sign-extension) directly prevents the overflow-to-infinite-loop flaw on the IOMMU invalidation path.
Prompt application of the kernel patch that moves the +1 and removes the overflow condition eliminates the CWE-835 defect before exploitation.
Engineering principles requiring safe integer arithmetic and loop termination conditions would have precluded the gather->end overflow in riscv IOMMU code.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover infinite-loop conditions before release.
Secure development life cycle mandates practices that can detect and prevent infinite-loop defects.
Application security requirements can specify loop-termination rules, indirectly reducing the weakness.
Secure coding standards directly address loop termination and prevent infinite loops.
Secure architecture principles encourage designs that avoid unreachable exit conditions.
Change management can require review of loop logic when code is modified.