Description
In the Linux kernel, the following vulnerability has been resolved:

debugobjects: Do not fill_pool() if pi_blocked_on

On RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which
asserts if current::pi_blocked_on is set, because a task can obviously only
block on one lock as otherwise the priority inheritenace chain gets
corrupted.

Prevent this by expanding the conditional to take current::pi_blocked_on
into account.
Published: 2026-07-01
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, the fill_pool() function in the debugobjects subsystem can call rtlock_lock() on real‑time (RT) enabled kernels. When the current task’s pi_blocked_on flag is set, rtlock_lock() asserts and forces a kernel panic. The vulnerability allows an attacker to provoke a denial‑of‑service condition by manipulating the debugging subsystem so that a task is blocked on priority inheritance while the kernel tries to allocate a debug object, causing the system to crash.

Affected Systems

The flaw affects Linux kernels configured with CONFIG_PREEMPT_RT (RT support) and with the debugobjects subsystem compiled. All RT‑enabled kernel builds prior to the inclusion of the fix for this debugobjects assertion are potentially vulnerable. No specific kernel versions are listed, so the scope includes all vulnerable RT builds.

Risk and Exploitability

Expected exploitation requires kernel‑mode execution or elevated privileges. Based on the description, it is inferred that these privileges are needed to trigger the suspicious debugobjects code path that leads to the assertion. Without such privileges, remote exploitation is unlikely. The EPSS score is not available, the vulnerability is not in the CISA KEV catalog, and the attack surface without privilege escalation remains low to moderate. Given that a kernel panic results, an attacker who can execute privileged code can bring the system down.

Generated by OpenCVE AI on July 1, 2026 at 23:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to the latest version that includes the fix for the debugobjects fill_pool() assertion on RT kernels.
  • If a patch is not immediately available, consider disabling the debugobjects subsystem (CONFIG_DEBUG_OBJECTS) or building the kernel without RT (CONFIG_PREEMPT_RT) until the vulnerability is corrected.
  • Monitor kernel release notes and advisories for updates; apply them promptly.

Generated by OpenCVE AI on July 1, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low


Wed, 01 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-748

Wed, 01 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-748

Wed, 01 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fill_pool() if pi_blocked_on On RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which asserts if current::pi_blocked_on is set, because a task can obviously only block on one lock as otherwise the priority inheritenace chain gets corrupted. Prevent this by expanding the conditional to take current::pi_blocked_on into account.
Title debugobjects: Do not fill_pool() if pi_blocked_on
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-01T13:32:13.493Z

Reserved: 2026-06-09T07:44:35.398Z

Link: CVE-2026-53327

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-01T00:00:00Z

Links: CVE-2026-53327 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T23:30:17Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition