Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. A flaw in how the system tracks register values could allow a mismatch between what the security verifier expects and what actually happens during execution. This type of discrepancy can potentially be used to bypass security checks, leading to unauthorized system access or instability.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's 'adjust_reg_min_max_vals()' function due to incorrect delta tracking for linked registers. When a BPF instruction uses the same register for both source and destination (e.g., rX += rX), the verifier modifies the register state in-place before calculating the delta. This causes the subsequent delta tracking logic to read the post-operation value instead of the original value, resulting in an incorrect delta being propagated via 'sync_linked_regs()'. This creates a verifier-vs-runtime mismatch, a primitive often used in BPF-based exploits to bypass memory safety checks. The issue is resolved by skipping delta tracking in this specific corner case.
Affected products
- Linux Linux Kernel 6.11, 6.18.33, 7.0.10
Timeline
- 2026-04-07: disclosed: Initial patch authored by Daniel Borkmann
- 2026-06-24: advisory: CVE-2026-53092 published in NVD