CVE-2026-53095: Linux Kernel Privilege Escalation Flaw

CVE-2026-53095 Overview

CVE-2026-53095 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw allows abuse of the kprobe_write_ctx attribute through the freplace program type. Uprobe BPF programs are permitted to modify struct pt_regs, but since uprobes share the underlying KPROBE program type, an attacker can attach a freplace program to a kprobe and inherit the write-context capability. When that kprobe attaches to a kernel function, the replacement program can rewrite the function's register state at runtime.

Critical Impact
A local attacker with BPF privileges can modify kernel function arguments by chaining freplace programs onto kprobe programs, undermining kernel integrity.

Affected Products

Linux kernel versions containing the BPF freplace and kprobe_write_ctx logic prior to the fix
Distributions shipping affected upstream kernels (see kernel.org stable commits)
Systems permitting unprivileged or CAP_BPF-enabled BPF program loading

Discovery Timeline

2026-06-24 - CVE-2026-53095 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53095

Vulnerability Analysis

The Linux BPF subsystem supports several program types, including BPF_PROG_TYPE_KPROBE, which covers both kprobe and uprobe attachments. Uprobe programs are allowed to modify struct pt_regs because user-space register state can be rewritten safely. Kprobe programs, however, must not modify kernel register state when attached to kernel functions, as doing so corrupts the calling convention of arbitrary kernel code paths.

The freplace (function replacement) program type lets one BPF program replace another's implementation. The verifier did not enforce that the kprobe_write_ctx attribute of the replacement matched the target. As a result, a freplace program declaring write access to pt_regs could be attached to a kprobe program that did not have such permission.

Root Cause

The root cause is a missing consistency check in the BPF verifier. When attaching a freplace program to a target program, the verifier did not compare the kprobe_write_ctx flag between the two. An attacker could declare freplace_kprobe with write semantics and attach it to a benign kprobe handler. The replacement then executes whenever the kprobe fires, with permission to modify kernel registers it was never authorized to touch.

Attack Vector

An attacker with the ability to load BPF programs writes a freplace program that mutates fields of struct pt_regs, such as setting regs->di = 0 to zero a function's first argument on x86_64. They attach this freplace program to a previously loaded kprobe program. When the kprobe fires at a kernel function entry, the replacement program executes and rewrites register state, altering kernel function arguments. This can be used to bypass security checks, corrupt kernel data structures, or enable further privilege escalation paths. Refer to the Linux Kernel Commit b312cf41b9 for the verifier fix details.

Detection Methods for CVE-2026-53095

Indicators of Compromise

Unexpected BPF programs of type freplace loaded on systems that do not normally use function replacement
bpf() syscalls from non-administrative processes performing BPF_LINK_CREATE against kprobe targets
Audit log entries showing BPF program loads with BPF_PROG_TYPE_EXT followed by attachment to kprobe programs

Detection Strategies

Monitor bpf() syscall activity and enumerate loaded BPF programs via bpftool prog list to identify unexpected freplace (ext) program types
Alert on kernel function tracing activity originating from non-root or unexpected user contexts
Correlate process telemetry with BPF program load events to detect chained kprobe and freplace attachments

Monitoring Recommendations

Enable Linux audit rules for the bpf syscall (-a always,exit -F arch=b64 -S bpf) and forward events to a centralized log pipeline
Track kernel symbol attachment for kprobes targeting sensitive functions such as credential, namespace, or capability handlers
Review BPF program signatures and verifier rejections to identify probing attempts against the patched code path

How to Mitigate CVE-2026-53095

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and reboot affected systems
Restrict BPF program loading to privileged users by setting kernel.unprivileged_bpf_disabled=1
Inventory hosts running unpatched kernels and prioritize remediation for multi-tenant or container workloads

Patch Information

The fix disallows attaching freplace programs to kprobe programs when the kprobe_write_ctx values differ. Patches are available in the following stable commits: Linux Kernel Commit 611fe4b79, Linux Kernel Commit 9836cadbd9, and Linux Kernel Commit b312cf41b9.

Workarounds

Disable unprivileged BPF via sysctl kernel.unprivileged_bpf_disabled=1 until patches are applied
Remove or restrict CAP_BPF and CAP_SYS_ADMIN from container workloads and service accounts that do not require them
Enforce a Linux Security Module policy (SELinux, AppArmor) that blocks BPF program loading from untrusted contexts

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf