Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. A technical error in how the system handles memory when copying data between certain internal maps could allow an attacker to read data outside of intended boundaries. This could potentially lead to the exposure of sensitive kernel memory or cause system instability.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the Linux kernel BPF subsystem within 'kernel/bpf/hashtab.c'. The root cause is an incorrect assumption in 'pcpu_init_value' that all source data sizes are rounded up to 8 bytes. When copying an element from a 'BPF_MAP_TYPE_CGROUP_STORAGE' map to a per-CPU (pcpu) map where the 'value_size' is not 8-byte aligned (e.g., 4 bytes), the 'copy_map_value_long' function attempts to read 8 bytes from a 4-byte source. This occurs because the verifier uses the exact size claimed by the source, while the copy logic rounds up, leading to an OOB read. The fix replaces 'copy_map_value_long' with 'copy_map_value' to respect the actual size. This typically requires local privileges to load and interact with BPF programs.
Affected products
- Linux Linux Kernel 5.10 to 6.6.141
Timeline
- 2026-04-02: disclosed: Initial patch submitted by Lang Xu
- 2026-06-24: advisory: CVE-2026-53076 published
References
- https://git.kernel.org/stable/c/576afddfee8d1108ee299bf10f581593540d1a36
- https://git.kernel.org/stable/c/6086079e6d1c32ba4c4b422612b8aebb1129a96c
- https://git.kernel.org/stable/c/634a793d0e1c822412095d25a1338f8831ad894c
- https://git.kernel.org/stable/c/e0378419b0e20178b5d100b27c9cc7e51064202e
- https://git.kernel.org/stable/c/e19c5ed9f1922a6854073f8651a63fa7be26e9e9