CVE-2026-53035: Linux Kernel eBPF Socket Map Deadlock DoS Vulnerability

Technical summary

The vulnerability exists in bpf_iter_unix_seq_show(), which calls lock_sock_fast() to acquire a socket lock while iterating Unix domain sockets. If the lock takes the fast path (acquiring slock-AF_UNIX directly), and the BPF program running during iteration calls sock_map_update_elem(), that function attempts to acquire bh_lock_sock() on the same socket lock. Since the lock is non-reentrant and already held, the kernel enters a deadlock state. The call stack shows the recursive lock acquisition attempt: __lock_sock_fast() → bpf_iter_run_prog() → sock_map_update_elem() → _raw_spin_lock() on the same slock-AF_UNIX. This is a classic lock ordering and reentrancy violation in the BPF iterator framework.

Business impact

An unprivileged local user with the ability to load BPF programs and execute BPF socket map operations can trigger this deadlock, causing denial of service (system hang or unresponsiveness). On systems where BPF programs are available to unprivileged users or in containerized environments, this could be exploited to crash workloads or degrade system performance. Systems using eBPF for network monitoring, socket filtering, or policy enforcement may experience unexpected service interruptions. The impact is containable to the affected process or kernel subsystem, but in shared multi-tenant environments, this could disrupt other services.

Affected systems

Linux kernel systems are affected. The vulnerability is present in the BPF subsystem's Unix socket iterator and socket map functionality. Systems running vulnerable kernel versions are susceptible if eBPF programs can be loaded and executed, particularly those with BPF capabilities enabled for local users, containers, or microservices. Check your Linux distribution's kernel version against the vendor advisory to determine if your systems are affected.

Exploitability

Exploitation requires local access and the ability to load and run eBPF programs. The CVSS score of 5.5 (Medium severity, local access, low complexity) reflects that privilege escalation is not necessary—a local user with BPF capabilities can trigger the deadlock. The vulnerability does not appear to be known to be exploited in the wild (not yet in the CISA KEV list), but the technical barrier to exploitation is low once BPF loading is permitted. Proof-of-concept code would involve crafting a BPF program that iterates Unix sockets while updating a socket map, which aligns with legitimate BPF use cases, making detection more challenging.

Remediation

The fix involves resolving the lock reentrancy issue in the BPF iterator framework. This typically requires modifying the locking strategy in bpf_iter_unix_seq_show() and sock_map_update_elem() to prevent recursive lock acquisition—either by using reentrant locks, relaxing lock requirements during iteration, or refactoring the call sequence to hold locks at the appropriate scope. Organizations should apply kernel updates from their Linux distribution that include the fix for CVE-2026-53035.

Patch guidance

Contact your Linux distribution (Red Hat, Ubuntu, Debian, etc.) for patched kernel versions. Vendors will backport the fix to stable kernel branches. Apply kernel updates through your standard patch management process. Test patches in a non-production environment first, especially given the low-level nature of lock handling changes. Verify the specific kernel version and build includes the fix referenced in the distribution's advisory.

Detection guidance

Monitor kernel logs for deadlock warnings and recursive locking detection messages (kernel warning: possible recursive locking detected on slock-AF_UNIX). Track BPF program load events and socket map update operations in audit logs. Performance monitoring may show sudden system hangs or CPU stalls that correlate with eBPF workload activity. In environments where BPF is actively used, correlate process-level hangs with eBPF program execution timelines.

Why prioritize this

Prioritize this vulnerability for systems where local users can load eBPF programs or where eBPF is used for network security and monitoring. The Medium CVSS score and local-only attack vector mean this is lower risk than remote exploits, but kernel deadlocks can degrade availability. Patch sooner if you run eBPF-dependent services (container runtimes, network policies, observability agents) or grant BPF capabilities to untrusted local code.

Risk score, explained

The CVSS 3.1 score of 5.5 is driven by high availability impact (A:H, the deadlock causes denial of service), local attack vector (AV:L, requiring system access), and low complexity (AC:L, standard BPF operations). Confidentiality and integrity are unaffected (C:N, I:N). The score is suppressed from higher severity due to the privilege requirement—an attacker needs local presence and BPF capability. The vulnerability is not yet in active exploitation (KEV: false), which further justifies Medium severity rather than High.

Frequently asked questions