What is CVE-2026-53126?

CVE-2026-53126 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 6.3 onward and patched in 6.6.141, 6.12.91, 6.18.33 and others. CVE-2026-53126 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53126?

CVE-2026-53126 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-53126?

Yes, CVE-2026-53126 has been patched. Fixed versions include 6.6.141, 6.12.91, 6.18.33 and others. If you are running Linux kernel 6.3 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53126 actively exploited?

CVE-2026-53126 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-53126

Medium

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed. Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

Package Linux Kernel

Published 2026-06-24

Last modified 2026-07-23

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.3 and later are affected. Fixed in 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 and their respective stable series.

Affected from

≥ 6.3

Fixed in

✓ 6.6.141 6.6.x ✓ 6.12.91 6.12.x ✓ 6.18.33 6.18.x ✓ 7.0.10 7.0.x ✓ 7.1

References

5 total

Kernel Git
https://git.kernel.org/stable/c/000e8454692cab9d1f1b80130e2870e355301d06

Patch
Kernel Git
https://git.kernel.org/stable/c/23308af722fefed00af5f238024c11710938fba3

Patch
Kernel Git
https://git.kernel.org/stable/c/4048ed98860d3785645ebbd34f69566a6c7320c3

Patch
Kernel Git
https://git.kernel.org/stable/c/73a5af059905d171b398c8b2381632ee499948b5

Patch
Kernel Git
https://git.kernel.org/stable/c/b3e005f16cd98f815429a87aef4c61e9c140779f

Patch

Details

CVE ID CVE-2026-53126

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-06-24

Modified 2026-07-23

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53126?

CVE-2026-53126 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.3 onward and has been patched in 6.6.141, 6.12.91, 6.18.33 and others. CVE-2026-53126 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53126?

CVE-2026-53126 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-53126?

Yes. CVE-2026-53126 has been patched. Fixed versions include 6.6.141, 6.12.91, 6.18.33 and others. If you are running Linux kernel 6.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53126 actively exploited?

No. CVE-2026-53126 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.