CVE-2026-53094: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53094 Overview

CVE-2026-53094 is a use-after-free vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw occurs when a device-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes Just-In-Time (JIT) compilation while constant blinding is enabled (bpf_jit_harden >= 2). During this process, bpf_jit_blind_constants() clones the program and frees the original, but the offload->prog back-pointer is not updated to reference the surviving clone. When the network namespace is later destroyed, the kernel dereferences the freed pointer and triggers a page fault in __bpf_prog_offload_destroy.

Critical Impact
A stale kernel pointer in the BPF offload path can cause kernel crashes and potential memory corruption when network namespaces are cleaned up.

Affected Products

Linux kernel versions implementing BPF dev-bound XDP programs with constant blinding hardening
Systems with net.core.bpf_jit_harden=2 enabled
Kernels exposing BPF_F_XDP_DEV_BOUND_ONLY to unprivileged or container workloads

Discovery Timeline

2026-06-24 - CVE-2026-53094 published to the National Vulnerability Database
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53094

Vulnerability Analysis

The vulnerability resides in the BPF JIT hardening pipeline. Device-bound-only XDP programs are unique because they carry an offload structure yet traverse the standard JIT path rather than bpf_prog_offload_compile(). This dual nature exposes them to constant blinding's clone-and-replace mechanism while requiring their offload->prog back-pointer to remain consistent.

When bpf_jit_blind_constants() clones the program, bpf_jit_prog_release_other() frees the original program. The cleanup routine updates aux->prog to point to the new clone but never updates offload->prog. The stale pointer survives until the network namespace is torn down. At that point, cleanup_net() invokes bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls __bpf_prog_offload_destroy(offload->prog) on freed memory.

Root Cause

The root cause is missing back-pointer synchronization. Both aux->prog and offload->prog reference the active program, but only aux->prog is refreshed after the clone replaces the original. The fix updates offload->prog inside bpf_jit_prog_release_other() alongside the existing aux->prog assignment, keeping both back-pointers in sync.

Attack Vector

A local actor with the ability to attach an XDP program inside a network namespace can trigger the condition. The reproducer requires setting net.core.bpf_jit_harden=2, loading a dev-bound-only XDP program on a veth interface inside a network namespace, and then destroying the namespace. The resulting page fault occurs in workqueue context (netns cleanup_net), producing a kernel oops at __bpf_prog_offload_destroy+0xc/0x80.

No verified exploit code is available. The crash signature documented in the upstream commit message is the canonical reference for the failure mode. See the Kernel Git Commit a713b72 for the resolved patch.

Detection Methods for CVE-2026-53094

Indicators of Compromise

Kernel oops messages referencing __bpf_prog_offload_destroy in the call trace
Page fault entries logged during cleanup_net workqueue execution
Unexpected unregister_netdevice_many_notify crashes following XDP program teardown

Detection Strategies

Audit hosts where net.core.bpf_jit_harden is set to 2 and dev-bound XDP programs are loaded inside namespaces
Monitor dmesg and the kernel ring buffer for BUG entries naming bpf_dev_bound_netdev_unregister
Correlate container or namespace lifecycle events with kernel crash telemetry to identify the trigger sequence

Monitoring Recommendations

Forward kernel crash and oops events to a centralized logging pipeline for retention and alerting
Track loaded BPF programs via bpftool prog show to identify programs created with the BPF_F_XDP_DEV_BOUND_ONLY flag
Alert on repeated veth teardown failures or network namespace cleanup errors

How to Mitigate CVE-2026-53094

Immediate Actions Required

Apply the upstream stable kernel patch that updates offload->prog inside bpf_jit_prog_release_other()
Inventory kernels with bpf_jit_harden=2 and prioritize patching workloads that use XDP inside network namespaces
Restrict the ability to load BPF programs to trusted administrators only

Patch Information

The fix is committed across multiple stable trees. Reference commits include Kernel Git Commit 059525c, Kernel Git Commit 25484c3, Kernel Git Commit a1aa9ef, Kernel Git Commit a713b72, and Kernel Git Commit c79f850. Rebuild and redeploy kernels using the stable branch that contains these commits.

Workarounds

Temporarily reduce net.core.bpf_jit_harden to 1 to disable constant blinding while assessing the risk of weaker JIT hardening
Avoid loading dev-bound-only XDP programs (BPF_F_XDP_DEV_BOUND_ONLY) until the patched kernel is deployed
Disable unprivileged BPF via kernel.unprivileged_bpf_disabled=1 to limit who can trigger the JIT path

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.core.bpf_jit_harden=1