CVE-2026-53106: Linux Kernel Privilege Escalation Flaw

CVE-2026-53106 Overview

CVE-2026-53106 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw allows a deadlock condition when BPF local storage elements are freed from a Non-Maskable Interrupt (NMI) or reentrant context. Deferred freeing of selem or local storage through kfree_rcu(), call_rcu(), or call_rcu_tasks_trace() may stall in these contexts. The maintainers resolved the issue by returning an error from bpf_xxx_storage_delete() helpers when invoked in NMI context. This was published to the National Vulnerability Database (NVD) on 2026-06-24.

Critical Impact
A BPF program executing in NMI or reentrant context that triggers local storage deletion can deadlock kernel RCU machinery, leading to denial of service on affected Linux hosts.

Affected Products

Linux kernel (upstream) — BPF subsystem
Distributions shipping vulnerable Linux kernel versions with BPF local storage support
Systems running BPF programs that delete local storage from tracing or perf-event NMI contexts

Discovery Timeline

2026-06-24 - CVE-2026-53106 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53106

Vulnerability Analysis

The vulnerability resides in the BPF local storage subsystem of the Linux kernel. BPF local storage allows BPF programs to attach key-value data to kernel objects such as tasks, sockets, cgroups, and inodes. When a storage element is deleted, the kernel defers the actual free using RCU primitives such as kfree_rcu(), call_rcu(), or call_rcu_tasks_trace(). These RCU primitives are not safe to invoke from NMI or reentrant contexts because they manipulate per-CPU state without sufficient locking guarantees. A BPF program attached to a perf event or kprobe that fires in NMI context and calls a bpf_xxx_storage_delete() helper can therefore deadlock the host. This is classified as a kernel race condition and deadlock issue [CWE-667].

Root Cause

The RCU deferral helpers used by bpf_selem_unlink() rely on locking and per-CPU data structures that may already be held when the CPU is interrupted by an NMI. Invoking them recursively from the NMI handler causes the locking invariants to break. The fix narrows the check to bpf_selem_unlink(), which is reachable from BPF helpers and syscalls. bpf_selem_unlink_nofail() remains unaffected because it only runs during map and owner teardown, paths that never execute in NMI or reentrant context.

Attack Vector

Exploitation requires the ability to load and attach a BPF program, which on most systems is restricted to privileged users with CAP_BPF or CAP_SYS_ADMIN. A locally privileged actor could attach a tracing BPF program to a high-frequency event that fires in NMI context and call a storage delete helper to induce the deadlock. The result is a kernel hang rather than memory corruption or code execution. The vulnerability has an Exploit Prediction Scoring System (EPSS) score of 0.145%, indicating low likelihood of exploitation in the wild.

No public proof-of-concept code is available. The vulnerability mechanism and fix are described in the upstream commits referenced by the Kernel Git Commit and the follow-up commit.

Detection Methods for CVE-2026-53106

Indicators of Compromise

Kernel soft lockup or RCU stall messages referencing bpf_selem_unlink, kfree_rcu, or call_rcu_tasks_trace in dmesg or /var/log/messages
Unexplained CPU hangs on hosts running BPF tracing workloads attached to perf events or kprobes
Loaded BPF programs that invoke bpf_task_storage_delete, bpf_sk_storage_delete, bpf_inode_storage_delete, or bpf_cgrp_storage_delete from NMI-capable attach points

Detection Strategies

Audit loaded BPF programs using bpftool prog show and inspect their attach types and helper usage
Monitor kernel ring buffer output for RCU stall warnings tied to BPF call stacks
Track use of BPF storage delete helpers from perf-event or NMI-context program types through kernel tracing

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central log platform to identify deadlock signatures
Alert on repeated INFO: rcu_sched detected stall or watchdog: BUG: soft lockup messages on Linux hosts
Inventory which users and workloads hold CAP_BPF or CAP_SYS_ADMIN and review program loads for unexpected attach types

How to Mitigate CVE-2026-53106

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry to all affected Linux hosts
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted system components and operators
Review third-party BPF programs for storage delete helpers used in NMI-context attach points and update them before deployment

Patch Information

The fix is delivered through two upstream commits that add an NMI check to bpf_selem_unlink() and return an error when the helper is invoked from NMI context. The commits are available at commit 350de5b8a9be and commit e84acaf93697. Distribution kernels should pick up the fix in their next stable update. Verify the running kernel version with uname -r after patching and reboot to load the new image.

Workarounds

Disable or unload BPF programs that call storage delete helpers from perf-event or kprobe attach points capable of running in NMI context
Use the kernel.unprivileged_bpf_disabled=1 sysctl to prevent unprivileged BPF program loading where supported
Restrict BPF program loading through Linux Security Modules such as SELinux or AppArmor until the patched kernel is deployed

bash

# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf

# Verify kernel version after applying the patched stable kernel
uname -r

# Audit currently loaded BPF programs and their attach types
bpftool prog show