CVE-2026-53036: Linux Kernel Privilege Escalation Flaw

CVE-2026-53036 Overview

CVE-2026-53036 is an off-by-one signed range check flaw in the Linux kernel's arm64 Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler. The check_imm(bits, imm) macro validates branch displacements before encoding them into B, B.cond, or CBZ/CBNZ AArch64 instructions. The existing logic accepts values in the range [-2^N, 2^N), which is effectively a signed (N+1)-bit range instead of the intended signed N-bit range. Out-of-range values pass validation and are then masked by aarch64_insn_encode_immediate(), corrupting the encoded branch target.

Critical Impact
Crafted BPF programs can cause the arm64 JIT to emit incorrect branch instructions, flipping forward branches into backward branches and producing unintended kernel control flow on arm64 systems.

Affected Products

Linux kernel arm64 BPF JIT subsystem
Stable kernel branches referenced by the upstream fix commits
AArch64-based Linux systems with BPF JIT enabled

Discovery Timeline

2026-06-24 - CVE-2026-53036 published to the National Vulnerability Database
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53036

Vulnerability Analysis

The arm64 BPF JIT uses check_imm(bits, imm) to verify that a branch displacement, expressed in arm64 instruction units, fits within the signed N-bit immediate field of a branch encoding. The macro tests (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits). This expression admits values in [-2^N, 2^N), which corresponds to a signed (N+1)-bit range rather than the intended signed N-bit range. The check therefore allows one extra bit of magnitude in both the positive and negative directions.

For check_imm19(), displacements in [2^18, 2^19) pass the check but exceed the 19-bit signed imm19 field of the B.cond encoding. aarch64_insn_encode_immediate() then masks the raw value into 19 bits, setting bit 18 (the sign bit). The encoder flips an intended forward branch into a backward branch. The same defect affects check_imm26() and the B/BL encoding used for unconditional branches. The fix shifts by (bits - 1) instead of bits so the encoder enforces the actual signed N-bit range.

Root Cause

The defect is an arithmetic boundary error in the immediate-range validation macro. Using imm >> bits rather than imm >> (bits - 1) defines a half-open range twice as wide as a signed N-bit field can represent [CWE-682, CWE-193].

Attack Vector

Exploitation requires the ability to load BPF programs that produce branch displacements just outside the legitimate signed range for imm19 or imm26. When such a program is JIT-compiled on arm64, the kernel emits malformed branch instructions with inverted direction or incorrect targets. The resulting behavior depends on what code resides at the corrupted branch destination. No verified public exploit or proof-of-concept code is currently available for CVE-2026-53036.

Detection Methods for CVE-2026-53036

Indicators of Compromise

Unexpected kernel crashes, oops messages, or BUG() reports on arm64 systems referencing the BPF JIT call path
Anomalous control flow or instruction faults originating from JIT-emitted code pages
Loading of BPF programs containing unusually large branch displacements on arm64 hosts

Detection Strategies

Audit kernel build metadata to identify arm64 hosts running pre-patch kernels with CONFIG_BPF_JIT=y
Inspect bpf() syscall telemetry for non-root or container-originated program loads on aarch64 systems
Correlate kernel ring buffer entries from arch/arm64/net/bpf_jit_comp.c with workload identity

Monitoring Recommendations

Enable kernel auditing for the bpf() syscall and forward events to a centralized logging pipeline
Monitor for kernel taint flags and JIT-related warnings on aarch64 production servers
Track BPF program loads by uid, container, and program type to baseline normal activity

How to Mitigate CVE-2026-53036

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable commits as soon as distribution updates become available
Inventory arm64 Linux hosts and identify those with BPF JIT enabled
Restrict unprivileged BPF program loading where operationally feasible

Patch Information

The fix replaces the shift width in check_imm() from bits to bits - 1, enforcing the correct signed N-bit range. Relevant commits include 1a113b5497297871699cd498b1b83542e0db7f15, 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec, 6927f0d6794aa73318bbfa929f1ff6065b0620df, 7fd3b41260c6120e7b60164afea5d961af6224f9, a5dfeb3b61065039488342d43ae06d4729d955d4, and fb74defa1cca1a73177c0c761e641332e4f979a3.

Workarounds

Disable the BPF JIT on arm64 by setting net.core.bpf_jit_enable=0 via sysctl until patches are deployed
Set kernel.unprivileged_bpf_disabled=1 to block unprivileged BPF program loads
Apply seccomp or LSM policies to deny the bpf() syscall to untrusted workloads and containers

bash

# Configuration example
sysctl -w net.core.bpf_jit_enable=0
sysctl -w kernel.unprivileged_bpf_disabled=1