CVE-2026-53036: Linux Kernel ARM64 BPF JIT Branch Encoding Off-by-One Privilege Escalation

Technical summary

The check_imm() macro in the ARM64 BPF JIT verifies that a signed branch displacement fits within an N-bit immediate field before encoding. The macro's current logic (imm >> bits for positive, ~imm >> bits for negative) validates a signed (N+1)-bit range instead of the required signed N-bit range. Specifically, check_imm19() accepts values in [2^18, 2^19), which overflow the 19-bit signed field used by B.cond instructions. When aarch64_insn_encode_immediate() masks such out-of-range values, bit 18 (the sign bit) gets set, inverting the branch direction. The same class of off-by-one error affects check_imm26() and B/BL instruction encodings. The fix shifts the comparison threshold by (bits - 1) rather than bits to enforce the correct [-2^(N-1), 2^(N-1)) range.

Business impact

This vulnerability enables local privilege escalation and kernel corruption on systems running affected Linux kernels with BPF enabled. A local user with standard privileges can load a malicious BPF program that exploits the range-check flaw, causing incorrect branch encoding that corrupts kernel memory. Environments relying on containers, VMs with unprivileged guest access, or systems where BPF is exposed to untrusted users face elevated risk. Attackers may gain root privileges, exfiltrate sensitive data, or crash the kernel.

Affected systems

The Linux kernel is affected across all architectures where the ARM64 BPF JIT is compiled—primarily ARM64 systems running kernels with BPF support. Embedded Linux devices, cloud virtual machines with ARM64 compute instances, and ARM-based server deployments are within scope. The vulnerability exists in mainline and stable kernel branches; systems must apply a kernel update to remediate.

Exploitability

Exploitability is high for systems where unprivileged BPF loading is permitted. Local code execution is required, but no special privileges are needed to load BPF programs on most distributions where BPF is enabled. Exploit development is straightforward: craft a BPF program with a branch displacement that triggers the off-by-one check, verify incorrect encoding occurs, and leverage the resulting branch inversion to corrupt kernel data structures. Active exploitation is not yet documented, but proof-of-concept code is likely to emerge quickly given the technical clarity of the flaw.

Remediation

Apply a kernel update that corrects the check_imm() macro to enforce the proper signed N-bit range. Verify the patched kernel explicitly tests the boundary values (e.g., 2^18 for check_imm19()) and rejects them. Until patching, disable unprivileged BPF loading by setting kernel.unprivileged_bpf_disabled = 1 and kernel.bpf_stats_enabled = 0 via sysctl, though this may break legitimate applications relying on BPF.

Patch guidance

Kernel maintainers have committed a fix that replaces the range-check logic with correct bit-shift thresholds. Verify the fix is included in your kernel branch by confirming the check_imm() macro now uses (bits - 1) instead of bits. Backports to stable and LTS kernels are expected; consult your distribution's security advisory for recommended patch versions. Test the patched kernel in a staging environment to ensure no regressions in BPF program functionality or performance.

Detection guidance

Monitor kernel logs for BPF program load rejections or unexpected branch instruction encodings. Tools like eBPF verifiers and static BPF checkers may flag programs with branch displacements near the boundary (e.g., close to 2^18 for 19-bit fields). Host-based intrusion detection can trigger on failed BPF program loads or kernel oops messages. Privilege escalation detection systems should flag local processes that suddenly gain root after BPF operations.

Why prioritize this

This vulnerability combines high CVSS impact (7.8 HIGH) with straightforward local exploitability and no special privilege requirement on most systems. It directly enables privilege escalation and kernel corruption, affecting availability, integrity, and confidentiality. ARM64 systems with enabled BPF and unprivileged user access should prioritize patching within 30 days.

Risk score, explained

CVSS 7.8 (HIGH) reflects local attack surface (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The score accurately captures the severity of kernel memory corruption and privilege escalation. The vulnerability is not currently tracked as known to be exploited in the wild (KEV status: false), but the technical clarity and local-only requirement make rapid exploitation likely.

Frequently asked questions