Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The system failed to properly check memory node identifiers when allocating memory pages within a specific 'arena' component. This could potentially lead to system instability or unexpected behavior if an invalid memory node is requested.
Technical details
The vulnerability exists in the arena_alloc_pages() function within kernel/bpf/arena.c. The function accepted a signed integer 'node_id' and forwarded it through the memory allocation chain without performing bounds checking against available NUMA nodes. An attacker or a malformed BPF program could provide an invalid node_id, leading to out-of-bounds access or kernel panics during page allocation. The fix introduces a validation check to ensure the node_id is either NUMA_NO_NODE or a valid, online node ID before proceeding with the allocation.
Affected products
- Linux Linux 6.9 through 7.0.9
Timeline
- 2026-04-17: patched: Initial fix committed to mainline kernel
- 2026-06-24: advisory: CVE-2026-53031 published