CVE-2026-53035: Linux Kernel Race Condition Vulnerability

CVE-2026-53035 Overview

CVE-2026-53035 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) sockmap subsystem. The flaw resides in bpf_iter_unix_seq_show(), where a recursive locking deadlock occurs when the AF_UNIX iterator program updates a sockmap. When lock_sock_fast() takes the fast path, the iterator BPF program calls sock_map_update_elem(), which then attempts to acquire bh_lock_sock() on the same socket already held by the iterator.

The result is a recursive acquisition of the slock-AF_UNIX spinlock on the same CPU, producing a kernel deadlock. The Linux kernel maintainers resolved the issue through a series of stable tree patches.

Critical Impact
Local unprivileged or privileged users with permission to load BPF iterator programs can trigger a kernel deadlock, resulting in denial of service on affected Linux hosts.

Affected Products

Linux kernel versions containing the BPF sockmap AF_UNIX iterator code path
Distributions shipping affected kernel versions prior to the fix commits
Systems with BPF iterator programs enabled and unprivileged BPF or CAP_BPF available

Discovery Timeline

2026-06-24 - CVE-2026-53035 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53035

Vulnerability Analysis

The vulnerability is a recursive locking deadlock [CWE-667] in the Linux kernel BPF subsystem. The kernel call trace shows the same slock-AF_UNIX spinlock acquired twice on a single CPU, which triggers the kernel's lockdep recursive locking detector.

The flow begins in bpf_seq_read(), which acquires the socket lock through bpf_iter_unix_seq_show(). Inside the iterator, lock_sock_fast() takes the fast path and acquires the bottom-half socket spinlock. The attached BPF iterator program then invokes sock_map_update_elem(), which calls bh_lock_sock() on the same socket. Because the spinlock is non-reentrant, the CPU spins indefinitely.

The deadlock requires the BPF iterator program to perform sockmap updates on sockets returned by the AF_UNIX iterator. This pattern is legitimate for BPF programs that manage sockmap entries based on socket enumeration.

Root Cause

The root cause is missing lock nesting protection between the AF_UNIX iterator socket lock acquisition and the sockmap update path. lock_sock_fast() and sock_map_update_elem() both attempt to acquire the same per-socket bottom-half spinlock without coordination. The iterator code did not account for BPF programs that update sockmaps while the socket is already locked.

Attack Vector

A local user with permission to load BPF iterator programs and update sockmaps can trigger this deadlock. The attacker writes a BPF iterator program targeting AF_UNIX sockets that calls bpf_map_update_elem() against a sockmap during iteration. Reading the iterator file descriptor causes the kernel to deadlock on the socket spinlock, blocking processes and degrading system availability.

No synthetic exploitation code is included. See the kernel call trace in the original advisory for the precise stack frames involved in the deadlock.

Detection Methods for CVE-2026-53035

Indicators of Compromise

Kernel log entries containing WARNING: possible recursive locking detected referencing slock-AF_UNIX
Stack traces showing sock_map_update_elem called from bpf_iter_run_prog and bpf_iter_unix_seq_show
Hung tasks or soft lockup warnings on processes performing BPF iterator reads
Unexpected CPU spin in kernel mode tied to AF_UNIX socket operations

Detection Strategies

Monitor /var/log/kern.log and dmesg for lockdep recursive locking warnings tied to AF_UNIX sockets
Audit BPF program loads through bpf() syscall telemetry, focusing on BPF_PROG_TYPE_TRACING iterator programs targeting unix
Track sock_map_update_elem invocations originating from iterator BPF programs using tracepoints
Correlate kernel soft lockup events with processes holding open BPF iterator file descriptors

Monitoring Recommendations

Collect kernel ring buffer output centrally and alert on recursive locking warnings
Capture BPF syscall arguments via auditd rules on bpf syscall to identify suspicious iterator program loads
Track installed kernel versions across the fleet and flag hosts lacking the fix commits
Monitor for processes consuming sustained kernel CPU on BPF read paths

How to Mitigate CVE-2026-53035

Immediate Actions Required

Apply the upstream kernel patches referenced below or update to a distribution kernel that includes them
Restrict the CAP_BPF and CAP_SYS_ADMIN capabilities to trusted users and service accounts only
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged BPF program loads
Inventory hosts running BPF iterator programs and prioritize patching those systems first

Patch Information

The Linux kernel maintainers published fixes across multiple stable trees. Apply the commit appropriate for your kernel branch: Kernel Patch 3cef33b, Kernel Patch 4d328dd, Kernel Patch 527057e, Kernel Patch 66d9fab, Kernel Patch 87828b3, and Kernel Patch bd35921.

Workarounds

Disable unprivileged BPF program loading at runtime where the fix is not yet deployed
Remove or revoke CAP_BPF from non-essential workloads and containers
Avoid deploying BPF iterator programs that update sockmaps until the patch is applied
Use seccomp or LSM policies to restrict the bpf() syscall on multi-tenant hosts

bash

# Configuration example
# Disable unprivileged BPF loads until kernel is patched
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf

# Verify running kernel version against patched commits
uname -r