CVE-2026-53096 Overview
CVE-2026-53096 is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) subsystem. The flaw resides in dev_map_redirect_multi() within the DEVMAP_HASH branch, which iterates hash buckets using hlist_for_each_entry_safe() instead of an RCU-safe variant. The function runs under RCU protection in softirq context via xdp_do_generic_redirect_map(), while concurrent writers modify the list using RCU primitives. On weakly-ordered architectures such as ARM64 and POWER, a reader can observe a partially-constructed node, leading to memory ordering violations.
Critical Impact
A race condition in BPF DEVMAP_HASH iteration can expose readers to partially-constructed nodes on weakly-ordered architectures, potentially causing kernel instability or memory corruption.
Affected Products
- Linux kernel BPF subsystem (dev_map_redirect_multi() SKB path)
- Linux kernel BPF subsystem (dev_map_enqueue_multi())
- Linux distributions running affected kernel versions on ARM64 and POWER architectures
Discovery Timeline
- 2026-06-24 - CVE-2026-53096 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53096
Vulnerability Analysis
The vulnerability affects the BPF DEVMAP_HASH iteration logic used during XDP (eXpress Data Path) generic redirect operations. The function dev_map_redirect_multi() uses hlist_for_each_entry_safe() to traverse hash buckets containing device map entries. This iterator performs plain pointer dereferences without rcu_dereference(), omitting the acquire barrier required to pair with writers' rcu_assign_pointer() calls.
Concurrent writers including __dev_map_hash_update_elem and dev_map_hash_delete_elem modify the same list using RCU primitives such as hlist_add_head_rcu() and hlist_del_rcu(). Without proper RCU-safe iteration, the reader may observe a node before its initialization completes on architectures with weak memory ordering. The flaw also defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race detection, masking other latent concurrency issues.
Root Cause
The root cause is the use of a non-RCU-aware iteration macro in a code path that runs under RCU read-side protection alongside concurrent RCU-mutating writers. Additionally, dev_map_enqueue_multi() uses an incorrect lockdep_is_held(&dtab->index_lock) condition where the lock is not actually held, producing false lockdep assertions.
Attack Vector
Exploitation requires triggering concurrent BPF device map updates while XDP generic redirect operations execute. The race window is narrow and architecture-dependent, with weakly-ordered systems (ARM64, POWER) most exposed. Local workloads using BPF programs with DEVMAP_HASH structures can trigger the condition. See the upstream patches for technical fix details, including Kernel Commit 4a3d0fe and Kernel Commit d4c4bd2.
Detection Methods for CVE-2026-53096
Indicators of Compromise
- Unexpected kernel warnings from CONFIG_PROVE_RCU lockdep validation related to dev_map_redirect_multi() or dev_map_enqueue_multi()
- KCSAN data-race reports referencing BPF devmap hash bucket iteration
- Sporadic kernel panics or null pointer dereferences in BPF redirect paths on ARM64 or POWER systems under load
Detection Strategies
- Enable CONFIG_PROVE_RCU and CONFIG_KCSAN in test kernels to surface RCU misuse and data races in BPF code paths
- Audit kernel versions deployed on ARM64 and POWER hosts to identify systems running pre-patch kernels
- Correlate kernel ring buffer (dmesg) entries with BPF program load events and XDP redirect activity
Monitoring Recommendations
- Track kernel package versions across the fleet and flag hosts running unpatched releases
- Collect dmesg and journalctl -k output centrally to identify lockdep warnings and BPF-related faults
- Monitor BPF program loading and devmap manipulation via auditd or eBPF telemetry for unexpected privileged activity
How to Mitigate CVE-2026-53096
Immediate Actions Required
- Apply the upstream Linux kernel patches that replace hlist_for_each_entry_safe() with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held() as the lockdep condition
- Update to the patched kernel release provided by your Linux distribution vendor
- Prioritize patching on ARM64 and POWER systems where weak memory ordering makes the race more observable
Patch Information
The fix replaces non-RCU iteration with hlist_for_each_entry_rcu() and corrects the lockdep condition in dev_map_enqueue_multi(). Relevant upstream commits include Kernel Commit 4a3d0fe, Kernel Commit 571a05e, Kernel Commit 7027e70, Kernel Commit 8ed82f8, Kernel Commit b089aae, Kernel Commit cb2c1f3, and Kernel Commit d4c4bd2.
Workarounds
- Restrict the CAP_BPF and CAP_SYS_ADMIN capabilities to trusted users to limit who can load BPF programs and manipulate device maps
- Disable or avoid BPF programs that use DEVMAP_HASH structures until the patched kernel is deployed
- Where feasible, deploy affected workloads on strongly-ordered architectures (x86_64) until patching completes on ARM64 and POWER hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
