CVE-2026-53083: Linux Kernel Race Condition Vulnerability

CVE-2026-53083 Overview

CVE-2026-53083 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the bpf_fd_array_map_clear() function within kernel/bpf/arraymap.c. The loop fails to invoke cond_resched(), preventing the kernel from yielding the CPU during long-running clear operations on PROG_ARRAY maps. Under load, this triggers Read-Copy-Update (RCU) stalls because the grace period kernel thread cannot make progress. The issue surfaces when many entries trigger expensive prog_array_map_poke_run() calls per iteration. Maintainers resolved the bug by adding the missing reschedule point.

Critical Impact
A workqueue path in the BPF arraymap clear logic can monopolize a CPU, producing RCU stalls and degraded system responsiveness on kernels running large PROG_ARRAY maps.

Affected Products

Linux kernel (mainline development tree, identified at version 6.14.0-13195-g967e8def1100)
Stable kernel branches receiving the backport commits referenced by upstream maintainers
Distributions shipping unpatched kernels that include the prog_array_map_clear_deferred workqueue path

Discovery Timeline

2026-06-24 - CVE-2026-53083 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53083

Vulnerability Analysis

The defect is a missing cooperative scheduling point inside the BPF arraymap clear routine. bpf_fd_array_map_clear() iterates across every entry of a file-descriptor-backed BPF array and calls __fd_array_map_delete_elem() for each. For PROG_ARRAY maps, that delete path invokes prog_array_map_poke_run(), which performs text patching on attached tail-call sites. Each call is non-trivial, and the loop runs without yielding. When a map contains many entries, the work item executing prog_array_map_clear_deferred holds the CPU long enough to block RCU grace periods. The kernel logs a stack dump with the RCU GP kthread unable to make progress and the worker stuck in write_comp_data and prog_array_map_poke_run. This falls under [CWE-833]-style resource starvation behavior and manifests as a denial of service condition for any workload sharing the affected CPU.

Root Cause

The loop in kernel/bpf/arraymap.c clearing PROG_ARRAY entries lacks a cond_resched() invocation. Without an explicit yield, preemption cannot occur on non-preemptible kernels, and RCU callbacks cannot run.

Attack Vector

A local user able to create and populate large PROG_ARRAY maps and trigger their deferred clear path can starve the CPU. The required CAP_BPF or equivalent privilege limits the scope, but the result is a kernel-level DoS impacting collocated workloads.

No verified public proof-of-concept code is available. The fault is reproduced by populating a large PROG_ARRAY and releasing its references so that prog_array_map_clear_deferred runs via the events workqueue. Refer to the upstream commits listed below for the technical fix.

Detection Methods for CVE-2026-53083

Indicators of Compromise

Kernel log entries reporting rcu: INFO: rcu_sched self-detected stall on CPU with stack frames including prog_array_map_poke_run and bpf_fd_array_map_clear.
Workqueue stalls on the events queue executing prog_array_map_clear_deferred for extended periods.
Soft lockup or hung task warnings emitted while BPF map teardown is in progress.

Detection Strategies

Monitor dmesg and /var/log/kern.log for RCU stall signatures correlated with BPF workqueue activity.
Track bpf syscall usage and large PROG_ARRAY map creation through audit rules on bpf(BPF_MAP_CREATE, ...).
Correlate periods of CPU saturation in kernel mode (%sys spikes) with BPF program lifecycle events.

Monitoring Recommendations

Enable kernel CONFIG_RCU_CPU_STALL_TIMEOUT reporting and forward kernel telemetry to a centralized logging platform.
Alert on repeated occurrences of prog_array_map_clear_deferred in stall traces, which indicate the unpatched code path is active.
Inventory hosts by kernel build identifier to identify systems still running pre-fix versions.

How to Mitigate CVE-2026-53083

Immediate Actions Required

Apply the upstream kernel fix that introduces cond_resched() into bpf_fd_array_map_clear().
Update to a stable kernel release that incorporates the referenced commits and reboot affected hosts.
Restrict CAP_BPF and unprivileged BPF (kernel.unprivileged_bpf_disabled=1) to limit who can create large PROG_ARRAY maps.

Patch Information

The fix is distributed across mainline and stable backports. See the Linux Kernel Commit 4406942, Linux Kernel Commit 67bdb4b, Linux Kernel Commit 71ddb7d, Linux Kernel Commit b1f7158, and Linux Kernel Commit e1ed678. Each adds the missing reschedule point in the clear loop.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent non-root users from invoking the vulnerable code path.
Limit the maximum size of PROG_ARRAY maps that workloads are permitted to allocate.
Reduce CPU contention by isolating critical RCU-sensitive workloads onto dedicated cores until the patched kernel is deployed.

bash

# Configuration example
# Disable unprivileged BPF until a patched kernel is installed
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo sysctl --system

# Verify the setting is active
sysctl kernel.unprivileged_bpf_disabled