CVE-2026-53090: Linux Kernel Privilege Escalation Flaw

CVE-2026-53090 Overview

CVE-2026-53090 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier. The flaw affects how the verifier analyzes ld_abs and ld_ind instructions when these are used inside BPF subprograms. The verifier fails to simulate the abnormal exit path generated by bpf_gen_ld_abs() when a packet data load fails. As a result, the verifier may approve BPF programs whose failure paths were never validated, weakening the safety guarantees the verifier is designed to enforce.

Critical Impact
The BPF verifier accepts subprograms containing ld_{abs,ind} instructions without validating the failure path, undermining a core safety invariant of the in-kernel BPF execution environment.

Affected Products

Linux kernel versions that include commit 09b28d76eac4 ("bpf: Add abnormal return checks") which extended ld_{abs,ind} usage into subprograms
BPF subsystem in mainline Linux kernel prior to the fix in commit ee861486e377edc55361c08dcbceab3f6b6577bd
Stable kernel branches receiving backport commit d846d83bdacbd8f14fc45c63b8c1d22608452e1c

Discovery Timeline

2026-06-24 - CVE-2026-53090 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53090

Vulnerability Analysis

The BPF verifier statically validates every code path a BPF program can take before allowing the program to load. For classic BPF (cBPF) ld_abs and ld_ind packet-load instructions, the code generator in bpf_gen_ld_abs() emits an abnormal exit sequence (r0 = 0; exit) that runs when the packet data load fails. This pattern dates back to legacy cBPF behavior.

Commit 09b28d76eac4 extended use of ld_{abs,ind} to subprograms, restricted to BTF-annotated subprograms with scalar return types. However, the verifier did not simulate the abnormal exit path for these subprograms. It only analyzed the success path, leaving the failure branch unverified.

Without simulating both branches, the verifier cannot prove safety properties on the failure side. The fix updates the verifier to push the success path (r0 = unknown, continue to next instruction) onto its evaluation stack and walk the fall-through failure path (r0 = 0, return to caller) directly, mirroring the handling already in place for tail calls.

Root Cause

The root cause is incomplete control-flow modeling in the BPF verifier for ld_{abs,ind} instructions inside subprograms. The verifier assumed a single continuation path after these instructions, but the code generator actually emits two: a success path and an abnormal exit path returning zero to the caller [CWE-754: Improper Check for Unusual or Exceptional Conditions].

Attack Vector

Exploitation requires the ability to load a BPF program. On a default Linux configuration, unprivileged BPF is disabled, so loading typically requires CAP_BPF or CAP_SYS_ADMIN. Where unprivileged BPF is enabled or where a process already holds the required capability, a crafted BPF program with ld_{abs,ind} in a subprogram could pass the verifier despite containing an unanalyzed control-flow path. The kernel commit references describe the fix; no public proof-of-concept is referenced in the advisory.

The vulnerability is described in prose only as no verified exploit code is published. See the upstream fix commit and the stable backport for the authoritative technical change.

Detection Methods for CVE-2026-53090

Indicators of Compromise

Unexpected BPF program loads from non-administrative user contexts in audit logs (SYSCALL records for bpf() with cmd=BPF_PROG_LOAD)
Kernel log entries from the BPF verifier referencing ld_abs or ld_ind usage inside subprograms
Loaded BPF programs visible via bpftool prog list that were not deployed by known system tooling

Detection Strategies

Audit bpf() syscall usage with auditd rules targeting BPF_PROG_LOAD and correlate with the invoking user and process
Inventory loaded BPF programs across hosts using bpftool prog show and compare against an approved baseline
Review kernel build version with uname -r to identify hosts running pre-fix kernels still capable of loading affected programs

Monitoring Recommendations

Continuously monitor kernel versions across the fleet and flag hosts that have not received the patched stable kernel
Alert on processes invoking bpf() outside expected observability, networking, or security tooling
Track changes to kernel.unprivileged_bpf_disabled and other BPF-related sysctls

How to Mitigate CVE-2026-53090

Immediate Actions Required

Update Linux kernels to a version that includes commit ee861486e377edc55361c08dcbceab3f6b6577bd or the stable backport d846d83bdacbd8f14fc45c63b8c1d22608452e1c
Confirm kernel.unprivileged_bpf_disabled is set to 1 or 2 on all production hosts
Restrict CAP_BPF and CAP_SYS_ADMIN to required service accounts only

Patch Information

The upstream fix is recorded in two kernel git commits referenced by NVD: mainline fix and stable backport. The patch updates the verifier in kernel/bpf/verifier.c to simulate both the success and failure paths of ld_{abs,ind} inside subprograms, pushing the success branch onto the verifier's evaluation stack and walking the r0 = 0; exit failure path as the fall-through. Apply distribution-provided kernel updates once they ship the corresponding backport.

Workarounds

Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl
Remove CAP_BPF from container security profiles where BPF program loading is not required
Enforce Lockdown mode (kernel.lockdown=confidentiality) where supported to constrain BPF interactions with kernel internals

bash

# Configuration example
# Disable unprivileged BPF program loading until kernel is patched
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-disable-unpriv-bpf.conf

# Verify the running kernel against patched commits
uname -r