CVE-2026-52938 Linux Kernel BPF Socket Storage NULL Pointer Dereference

Technical summary

CVE-2026-52938 addresses a use-after-free style race condition in net/core/bpf_sk_storage.c. The function bpf_selem_unlink_nofail() nullifies the SDATA(selem)->smap pointer before removing the selem from the storage hlist, creating a window where concurrent RCU readers in bpf_sk_storage_clone() can observe a list entry with a NULL smap. This manifests as a general protection fault when the code attempts to dereference the null smap pointer at offset 0x50. The issue also exists in bpf_sk_storage_diag_put_all(), which shares the same pattern. The fix introduces NULL checks in bpf_sk_storage_clone() and refactors bpf_sk_storage_diag_put_all() to validate smap before passing it to diag_get(), reducing the window for the race condition.

Business impact

This vulnerability can cause kernel panics on systems with BPF socket storage in active use, leading to unexpected system downtime and denial of service. Organizations relying on containerization, Kubernetes, or advanced networking tools that leverage eBPF extensively face elevated risk. While local privilege is required to exploit this, the impact is severe for multi-tenant environments or systems where unprivileged users have legitimate access to network functionality.

Affected systems

The Linux kernel is affected. The vulnerability is present in BPF socket storage code paths activated during TCP socket cloning and diagnostic operations. Systems running kernels with BPF support enabled and active socket storage operations are at risk. Verify the specific kernel version against the vendor's patch advisories, as the fix requires kernel update to a patched version.

Exploitability

Exploitation requires local access and unprivileged user privilege level. The race condition is inherently probabilistic, dependent on timing between socket cloning and storage cleanup, making reliable triggering non-trivial. However, workloads with high connection churn or continuous socket cloning can increase the likelihood of triggering the NULL dereference. No known public exploits exist as this is a kernel stability issue rather than a traditional privilege escalation or code execution vector.

Remediation

Update the Linux kernel to a patched version that includes the NULL pointer checks and diag_get() refactoring. Kernel maintainers have released fixes addressing both bpf_sk_storage_clone() and bpf_sk_storage_diag_put_all() code paths. Consult your Linux distribution's security advisories for specific patched kernel versions. Interim mitigation is limited; disabling BPF socket storage is not practical for most deployments.

Patch guidance

Apply kernel updates from your distribution as soon as available. The fix is relatively small and surgical—adding NULL checks and refactoring the diag function parameter passing—so patch deployments should not introduce new regressions. Test patched kernels in staging environments before production rollout, particularly if your workload relies heavily on eBPF or runs containerized services with BPF hooks.

Detection guidance

Monitor kernel logs for general protection faults or KASAN reports mentioning bpf_sk_storage_clone or bpf_sk_storage_diag_put_all. In production, watch for unexpected kernel panics during periods of high socket creation or TCP connection churn. Systems running kernel address sanitizer (KASAN) builds will surface this issue more reliably. Correlate crashes with eBPF program activity and container orchestration events.

Why prioritize this

This CVSS 5.5 MEDIUM vulnerability should be prioritized for patching in production environments with heavy BPF usage or frequent socket cloning (e.g., Kubernetes nodes, load balancers, container hosts). The local-only requirement and need for user privilege reduce criticality, but the kernel crash impact justifies prompt remediation. Organizations should defer patching only if they can confirm BPF socket storage is not in active use.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector with low complexity, unprivileged access, and high availability impact (kernel crash). There is no confidentiality or integrity impact. The score appropriately balances the severe crash consequence against the requirement for local access and timing-dependent exploitation. Real-world risk is elevated for infrastructure serving multiple tenants or running container orchestration.

Frequently asked questions