Executive brief
A vulnerability was identified in the Linux kernel's networking component (BPF DEVMAP). On certain hardware architectures like ARM64, this could allow a system to read partially-constructed data during network redirection tasks. This may lead to unpredictable system behavior or crashes, potentially impacting the reliability of network services.
Technical details
A race condition exists in the DEVMAP_HASH branch of dev_map_redirect_multi() within the Linux kernel. The code used hlist_for_each_entry_safe() for iteration under RCU protection instead of the required RCU-safe primitives. Because this function performs plain pointer dereferences without proper acquire barriers, concurrent writers using RCU primitives could cause readers on weakly-ordered architectures (such as ARM64 or POWER) to observe partially-constructed nodes. This flaw also bypassed CONFIG_PROVE_RCU validation and KCSAN detection. The fix replaces the unsafe iteration with hlist_for_each_entry_rcu() and corrects lockdep conditions.
Affected products
- Linux Linux Kernel e624d4ed4aa8 to 8ed82f807bb0
Timeline
- 2026-03-20: disclosed: Initial patch submission
- 2026-06-01: patched: Patch committed to stable tree
- 2026-06-24: advisory: CVE-2026-53096 published
References
- https://git.kernel.org/stable/c/4a3d0fe30b907ff324b1b49756f7e713d67f3645
- https://git.kernel.org/stable/c/571a05ea1baaccc0dc1e0d227b2cbc978b96d392
- https://git.kernel.org/stable/c/7027e705062482a8cea43a1c13ede3c35653966f
- https://git.kernel.org/stable/c/8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19
- https://git.kernel.org/stable/c/b089aa6e94d7a08e74d076a0fe274842dc9feccc
- https://git.kernel.org/stable/c/cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a
- https://git.kernel.org/stable/c/d4c4bd231ebad70e6f30db429e9640bf378b2f52