CVE-2026-53110: Linux Kernel Privilege Escalation Flaw

CVE-2026-53110 Overview

CVE-2026-53110 affects the Linux kernel's s390/bpf JIT compiler. The s390x Application Binary Interface (ABI) requires callers to zero-extend unsigned arguments and sign-extend signed arguments. Callees must zero-extend unsigned return values and sign-extend signed return values. The s390 BPF Just-In-Time (JIT) compiler implemented only sign extension and omitted zero extension for BPF program return values and kfunc arguments. This ABI mismatch can produce incorrect register contents when BPF code interacts with kernel functions on IBM Z (s390x) systems. The maintainers resolved the issue across multiple stable kernel branches.

Critical Impact
Incorrect zero-extension in the s390 BPF JIT can cause kfunc arguments and BPF return values to contain stale upper bits, leading to unpredictable kernel behavior on s390x platforms.

Affected Products

Linux kernel on s390x (IBM Z) architecture using the BPF JIT compiler
Stable kernel branches receiving backports referenced in the kernel.org commits
Workloads relying on BPF programs that invoke kfuncs or return integer values

Discovery Timeline

2026-06-24 - CVE-2026-53110 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53110

Vulnerability Analysis

The vulnerability resides in the s390 BPF JIT (arch/s390/net/bpf_jit_comp.c) which compiles eBPF bytecode to native s390x machine instructions. According to the s390x ABI, integer values narrower than 64 bits must be extended to the full register width before being passed between callers and callees. Unsigned values require zero-extension, while signed values require sign-extension.

The existing JIT implementation handled sign-extension correctly but omitted zero-extension for BPF program return values and for arguments passed to kernel functions (kfuncs) invoked from BPF programs. As a result, the upper bits of relevant registers could contain residual data from prior computations rather than the expected zero bits.

This class of issue is categorized as a sign extension error and a form of improper input validation at the calling convention boundary. The exploitation surface depends on how callers interpret the contaminated upper bits.

Root Cause

The root cause is incomplete ABI compliance in the s390 BPF JIT. The JIT emitted instructions to sign-extend signed values but did not emit equivalent zero-extension instructions for unsigned values. When a BPF program returned an unsigned 32-bit value or passed an unsigned argument to a kfunc, the unused high-order bits of the 64-bit s390x register were left undefined.

Attack Vector

This is a kernel-internal correctness defect rather than a directly exploitable network or user-facing flaw. Triggering the inconsistent register state requires the ability to load and execute BPF programs that interact with kfuncs on an s390x kernel. The vulnerability description and metadata do not indicate a known exploitation path, and the EPSS data places exploitation likelihood in a low percentile.

No verified public exploit code is associated with this CVE. Refer to the upstream commits at git.kernel.org commit 202e42e4 and git.kernel.org commit 44c4f999 for the exact JIT instruction changes.

Detection Methods for CVE-2026-53110

Indicators of Compromise

No file-based or network indicators are associated with this kernel JIT defect.
Anomalous BPF program return values or unexpected kfunc behavior on s390x hosts may correlate with exposure.
Kernel logs showing BPF verifier or runtime warnings on IBM Z systems warrant review.

Detection Strategies

Inventory s390x Linux hosts and identify kernel versions predating the fixes referenced in the kernel.org commits.
Audit deployed BPF programs that invoke kfuncs to determine exposure to the JIT defect.
Compare running kernel build identifiers against vendor advisories for distributions that ship s390x kernels.

Monitoring Recommendations

Monitor for unauthorized loading of BPF programs using bpf() syscall auditing on s390x systems.
Track kernel package versions and patch state across IBM Z fleets using configuration management telemetry.
Review dmesg and journal output for BPF JIT-related warnings after kernel upgrades.

How to Mitigate CVE-2026-53110

Immediate Actions Required

Apply the upstream patches from the referenced kernel.org commits to all affected s390x kernels.
Update to a distribution kernel that incorporates the zero-extension fix for s390 BPF JIT.
Restrict the ability to load BPF programs to trusted administrators by limiting CAP_BPF and CAP_SYS_ADMIN.

Patch Information

The fix is distributed across multiple stable branches. Reference commits include 202e42e4aa89, 366b0e05ee24, 44c4f999b03f, 834918a77be5, and edc90a12073b. The patches emit explicit zero-extension instructions for BPF program return values and kfunc arguments in the s390 JIT.

Workarounds

Disable unprivileged BPF on s390x hosts by setting kernel.unprivileged_bpf_disabled=1.
Where feasible on affected kernels, fall back to the BPF interpreter by setting net.core.bpf_jit_enable=0 until patches are applied.
Limit deployment of third-party BPF programs on IBM Z systems pending kernel update.

bash

# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1

# Temporarily disable the BPF JIT (forces interpreter)
sysctl -w net.core.bpf_jit_enable=0

# Verify running kernel version on s390x
uname -m && uname -r