CVE-2026-53243

The record

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization.

Affected packages

Related vulnerabilities

• CVE-2026-119602 libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in… CWE-908
• CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allows… CWE-908
• CVE-2026-116739 VMime through 0.9.2 contains an information disclosure vulnerability in the… CWE-908
• CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. CWE-908
• CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an… CWE-908
• CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver… CWE-908
• CVE-2026-114501 Pillow is a Python imaging library. CWE-908
• CVE-2026-112897 Pillow is a Python imaging library. CWE-908