Junglewise Threat Intelligence

CVE-2026-53110: Linux Kernel s390x BPF JIT incorrect register extension

CVE-2026-53110 · Severity: info · CVSS 0 · Published 2026-06-24

Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) component for s390x architectures. The system failed to correctly handle certain types of data values (unsigned arguments and return values) when executing BPF programs, which could lead to unpredictable behavior or security bypasses within the kernel. This issue has been resolved in recent kernel updates.

Technical details

A vulnerability in the s390x BPF JIT compiler (arch/s390/net/bpf_jit_comp.c) stemmed from a failure to adhere to the s390x ABI requirements regarding register extension. While the ABI requires callers to zero-extend unsigned arguments and callees to zero-extend unsigned return values, the BPF JIT implementation only performed sign extension. This mismatch can lead to incorrect data processing when BPF programs interact with kernel functions (kfuncs). The fix replaces the `sign_extend` logic with a `sign_zero_extend` function that correctly handles both signed and unsigned types based on the BTF (BPF Type Format) model flags. This issue was introduced in the implementation of `arch_prepare_bpf_trampoline()`.

Affected products

  • Linux Linux 6.3 to 6.6.140, 6.12.90, 6.18.32, 7.0.9

Timeline

  • 2026-03-13: patched: Initial fix committed to mainline kernel.
  • 2026-06-24: disclosed: CVE-2026-53110 published.

References