What is CVE-2026-53063?

CVE-2026-53063 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 4.12 onward and patched in 6.1.175, 6.6.141, 6.12.91 and others. CVE-2026-53063 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53063?

CVE-2026-53063 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-53063?

Yes, CVE-2026-53063 has been patched. Fixed versions include 6.1.175, 6.6.141, 6.12.91 and others. If you are running Linux kernel 4.12 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53063 actively exploited?

CVE-2026-53063 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-53063

Medium

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidate_remove() function has incomplete logic for handling write hit bios after cache invalidation. It sets up the remapping for the overwrite_bio but then drops it immediately without submission, causing write operations to hang. Fix by adding a new invalidate_committed() continuation that submits the remapped writes to the cache origin after metadata commit completes, while using the overwrite_endio hook to ensure proper completion sequencing. This maintains existing coherency. Also improve error handling in invalidate_complete() to preserve the original error status instead of using bio_io_error() unconditionally.

Package Linux Kernel

Published 2026-06-24

Last modified 2026-07-21

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 4.12 and later are affected. Fixed in 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 and their respective stable series.

Affected from

≥ 4.12

Fixed in

✓ 6.1.175 6.1.x ✓ 6.6.141 6.6.x ✓ 6.12.91 6.12.x ✓ 6.18.33 6.18.x ✓ 7.0.10 7.0.x ✓ 7.1

References

6 total

Kernel Git
https://git.kernel.org/stable/c/05798d091ebcfb6d68228890e593f209e8ac940d

Patch
Kernel Git
https://git.kernel.org/stable/c/4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b

Patch
Kernel Git
https://git.kernel.org/stable/c/64d6519b00be4116d365bd31f33a5e5ce2944c1a

Patch
Kernel Git
https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78

Patch
Kernel Git
https://git.kernel.org/stable/c/b8ace9e96983abb20ccf39edce8a60f1bb0b83d8

Patch

Showing 5 of 6 references View all on NVD

Details

CVE ID CVE-2026-53063

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-06-24

Modified 2026-07-21

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53063?

CVE-2026-53063 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 4.12 onward and has been patched in 6.1.175, 6.6.141, 6.12.91 and others. CVE-2026-53063 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53063?

CVE-2026-53063 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-53063?

Yes. CVE-2026-53063 has been patched. Fixed versions include 6.1.175, 6.6.141, 6.12.91 and others. If you are running Linux kernel 4.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53063 actively exploited?

No. CVE-2026-53063 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.