CVE-2026-53076: Linux Kernel BPF Out-of-Bounds Memory Read Vulnerability

Technical summary

CVE-2026-53076 is an out-of-bounds (OOB) read vulnerability in the Linux kernel's BPF subsystem, specifically in the pcpu_init_value function. The flaw occurs during map element updates when copying data from a BPF_MAP_TYPE_CGROUP_STORAGE map (or similar non-8-byte-aligned sources like skb->data) to a per-CPU map with matching but unaligned value_size (e.g., 4 bytes). The pcpu_init_value function invokes copy_map_value_long assuming all sources are 8-byte aligned, but the BPF verifier only validates the actual claimed size. When the source is 4 bytes and the copy operation rounds up to 8 bytes, an OOB read occurs. This is a CWE-125 (Out-of-bounds Read) issue stemming from incorrect size assumptions in the kernel's memory handling logic.

Business impact

This vulnerability enables local privilege escalation and information disclosure on Linux systems. A non-root user can exploit the OOB read to extract sensitive kernel memory—potentially including cryptographic material, heap metadata, or other privileged data. Systems where local users have BPF access (often constrained by CAP_BPF or CAP_SYS_ADMIN) face direct risk. The HIGH CVSS score (7.1) reflects the combination of high confidentiality impact and high availability impact (potential kernel crash), though it requires local access and existing privileges. Workloads running containerized or multi-tenant environments are particularly vulnerable if BPF is enabled and user isolation is incomplete.

Affected systems

All Linux kernel versions implementing the BPF subsystem with CGROUP_STORAGE map support are affected. The vulnerability requires that: (1) a system exposes BPF capabilities to local users (via CAP_BPF or CAP_SYS_ADMIN), and (2) CGROUP_STORAGE maps or other non-8-byte-aligned map sources are accessible. Systems running recent mainline kernels, stable branches (5.15+, 6.1+, 6.6+), and distributions that enable BPF features are in scope. Verify against the vendor advisory for exact affected versions and patch availability.

Exploitability

Exploitation requires local access and either CAP_BPF or CAP_SYS_ADMIN capability. The attack is straightforward: create a CGROUP_STORAGE map with a non-standard value_size (e.g., 4 bytes), create a per-CPU map with the same size, then update the per-CPU map with data from the CGROUP_STORAGE map. The kernel will read and copy 8 bytes instead of 4, leaking 4 bytes of adjacent kernel memory. This is a logic error, not a complex exploitation chain, making it accessible to any privileged local user. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been widely reported, but the simplicity of the trigger means rapid weaponization is plausible once disclosed.

Remediation

Apply the Linux kernel patch that fixes pcpu_init_value to correctly validate and respect non-8-byte-aligned source sizes. The fix involves checking the actual source value_size rather than assuming 8-byte alignment, and adjusting the copy operation accordingly. For immediate risk reduction on systems where full patching is delayed, restrict BPF access by disabling unprivileged BPF (via kernel.unprivileged_bpf_disabled=1 in sysctl) or limiting CAP_BPF/CAP_SYS_ADMIN grants to trusted processes only. Monitor kernel logs for BPF map update errors that may indicate exploitation attempts.

Patch guidance

Obtain and test the patched kernel version from your Linux distribution's security update channel. Patches are expected in stable series including 5.15.x, 6.1.x, 6.6.x, and later mainline releases. Verify against your vendor's security advisory for the specific version number that resolves CVE-2026-53076. Patch testing should include regression testing of BPF workloads (eBPF programs, container runtime security tools, observability agents) to ensure no functional breakage. Schedule patching as HIGH priority for systems with local user access or container environments; lower priority for isolated infrastructure with restricted user privileges.

Detection guidance

Monitor for suspicious BPF map operations via audit logs (auditctl rules on BPF syscalls) or eBPF-based runtime security tools. Look for sequences of bpf(BPF_MAP_CREATE) calls for CGROUP_STORAGE and per-CPU maps with matching non-standard value_sizes, followed by bpf(BPF_MAP_UPDATE_ELEM). Kernel logs may show memory-related warnings or crashes if exploitation causes data corruption. Implement seccomp profiles to restrict BPF syscalls on non-production systems. eBPF runtime monitors (Falco, Tracee, etc.) can detect anomalous BPF program loading and map manipulation if configured with appropriate rules.

Why prioritize this

This vulnerability merits HIGH priority for patching due to its CVSS 7.1 score, memory disclosure capability, and accessibility to local users with standard privileges. While it requires local access (reducing attack surface vs. remote flaws), the simplicity of exploitation and lack of mitigating complexity make it attractive to adversaries post-compromise. Prioritize systems with: (1) multi-tenant or container workloads, (2) enabled BPF with unprivileged user access, (3) sensitive workloads (crypto, secret management). Defer patching only if BPF is explicitly disabled and CAP_BPF is revoked system-wide.

Risk score, explained

CVSS 3.1 base score of 7.1 (HIGH) reflects: AV:L (local attack only, not network-exploitable), AC:L (low attack complexity, simple reproduction), PR:L (low privilege required—standard user with BPF access), UI:N (no user interaction), S:U (no scope escalation across privilege boundaries), C:H (high confidentiality impact via memory leak), I:N (no direct integrity impact), A:H (high availability impact due to kernel crash potential). The score correctly captures that this is a serious local information disclosure with stability implications, but not as critical as remote or unauthenticated flaws.

Frequently asked questions