CVE-2026-53076: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53076 Overview

CVE-2026-53076 is an out-of-bounds read vulnerability in the Linux kernel Berkeley Packet Filter (BPF) subsystem. The flaw resides in the pcpu_init_value function, which incorrectly assumes that all source data is rounded up to 8 bytes before copying. When a BPF_MAP_TYPE_CGROUP_STORAGE map with a value_size not aligned to 8 bytes (such as 4 bytes) is used as the source for an update to a per-CPU (pcpu) map, the kernel performs copy_map_value_long and reads beyond the allocated source buffer.

Critical Impact
An unprivileged process with BPF access can trigger a kernel out-of-bounds read, potentially leaking adjacent kernel memory contents.

Affected Products

Linux kernel (BPF subsystem, pcpu_init_value code path)
Kernel builds that expose BPF_MAP_TYPE_CGROUP_STORAGE and per-CPU BPF maps
Stable kernel branches prior to the commits referenced in the upstream fix series

Discovery Timeline

2026-06-24 - CVE-2026-53076 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53076

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Linux kernel BPF map update path. When updating a per-CPU BPF map from another map element, the kernel invokes pcpu_init_value to initialize per-CPU values. That function calls copy_map_value_long, which copies in 8-byte aligned chunks under the assumption that the source buffer was rounded up to 8 bytes at allocation time.

That assumption does not hold for every BPF source. Maps such as BPF_MAP_TYPE_CGROUP_STORAGE and other sources like skb->data can present a value_size of 4 bytes without trailing alignment padding. The BPF verifier validates exactly the size the source declares, not the rounded-up size used by the copy routine.

As a result, when the source value_size is 4 bytes and the destination pcpu map shares the same value_size, the kernel reads 8 bytes from a 4-byte source. The extra 4 bytes are adjacent kernel heap memory, leading to information disclosure and potential further compromise depending on what data resides next to the source allocation.

Root Cause

The root cause is a mismatch between the kernel's size-rounding contract and what the BPF verifier enforces. copy_map_value_long relies on 8-byte aligned source allocations, but cgroup storage values and packet data are not always padded. The fix adjusts the copy logic so it no longer over-reads when the declared value_size is not a multiple of 8.

Attack Vector

A local attacker with the ability to create and update BPF maps can chain a BPF_MAP_TYPE_CGROUP_STORAGE map with a 4-byte value_size to a per-CPU BPF map of identical size. Triggering an element update copies past the end of the source buffer, exposing adjacent kernel memory to the attacker through subsequent map reads or side channels.

No verified public exploit code is available. See the upstream patches for technical details: Kernel Commit 576afdd, Kernel Commit 6086079, Kernel Commit 634a793, Kernel Commit e037841, and Kernel Commit e19c5ed.

Detection Methods for CVE-2026-53076

Indicators of Compromise

Unexpected processes invoking the bpf() syscall to create BPF_MAP_TYPE_CGROUP_STORAGE maps with non-8-byte aligned value_size.
Sequential creation of cgroup storage and per-CPU BPF maps followed by cross-map element updates from unprivileged or low-trust contexts.
KASAN reports or kernel log entries flagging out-of-bounds access in pcpu_init_value or copy_map_value_long.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to surface the OOB read during fuzzing or regression testing.
Audit bpf() syscall telemetry for workloads creating cgroup storage maps with value_size values like 1, 2, 3, 4, 5, 6, or 7 bytes.
Correlate BPF map creation events with the loading user, container, and cgroup to identify anomalous BPF usage outside expected applications.

Monitoring Recommendations

Collect Linux audit (auditd) records for the bpf syscall and forward them to a centralized analytics platform for review.
Track kernel ring buffer messages for KASAN, slab, or BPF verifier warnings on production hosts.
Inventory which workloads legitimately require CAP_BPF or CAP_SYS_ADMIN and alert on new processes acquiring those capabilities.

How to Mitigate CVE-2026-53076

Immediate Actions Required

Apply the upstream BPF fix series referenced in the kernel commits as soon as your distribution publishes updated stable kernels.
Restrict unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF.
Limit CAP_BPF and CAP_SYS_ADMIN to trusted workloads and remove these capabilities from container runtimes where not required.

Patch Information

The fix is delivered through five upstream commits in the Linux stable tree: 576afdd, 6086079, 634a793, e037841, and e19c5ed. The patches correct the copy length used in pcpu_init_value so that sources with a value_size not aligned to 8 bytes are no longer over-read. Track your distribution vendor's security advisories and install the kernel package that includes these commits.

Workarounds

Disable unprivileged BPF system-wide using sysctl -w kernel.unprivileged_bpf_disabled=1 until kernels are patched.
Block container and pod specifications that grant CAP_BPF, CAP_PERFMON, or CAP_SYS_ADMIN to workloads that do not require BPF map operations.
Use seccomp filters to deny the bpf() syscall for application containers that have no legitimate BPF requirement.

bash

# Disable unprivileged BPF as a temporary mitigation
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify the setting
sysctl kernel.unprivileged_bpf_disabled