CVE-2026-53078: Linux Kernel BPF sock_ops Pointer Leak and Stack Corruption

Technical summary

The vulnerability exists in the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros used during BPF sock_ops program verification and JIT compilation. When dst_reg equals src_reg (same register used for both source and destination operands), these macros temporarily borrow a register to check socket state flags (is_fullsock and is_locked_tcp_sock). On the negative path—when a socket is not in a fully-established state (e.g., TCP_NEW_SYN_RECV with a request_sock)—the destination register should be zeroed but is not. This leaves the original ctx pointer (kernel context structure address) in dst_reg. The verifier incorrectly tags this as PTR_TO_SOCKET_OR_NULL (for SOCK_OPS_GET_SK) or SCALAR_VALUE (for SOCK_OPS_GET_FIELD), enabling either stack-out-of-bounds reads via socket helpers or direct kernel pointer leaks. The fix involves correcting jump offsets and explicitly zeroing dst_reg in the failure path after temporary register restoration.

Business impact

A local attacker with BPF program load permissions can compromise kernel confidentiality and integrity. Information disclosure of kernel pointers defeats address space layout randomization (ASLR) hardening, facilitating further exploits. Stack corruption can trigger denial of service or privilege escalation chains. In containerized or multi-tenant environments where unprivileged users have BPF capabilities enabled, this becomes a high-priority container escape vector. Affected organizations should evaluate whether their threat model includes local attackers with CAP_BPF/CAP_PERFMON privileges.

Affected systems

All Linux kernel versions containing the vulnerable SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros in BPF sock_ops handling. The vulnerability affects any deployment where BPF sock_ops programs are permitted (this may be disabled by default on some distributions). Systems with unprivileged user namespaces and BPF enabled are at elevated risk.

Exploitability

Exploitation requires local access and the ability to load BPF programs (typically CAP_BPF and CAP_PERFMON, or older CAP_SYS_ADMIN). This is not a remote vulnerability. Craft is moderate: an attacker must write a sock_ops BPF program that triggers the same-register code path and either leaks kernel pointers or corrupts stack via a helper function. Public proof-of-concept code does not currently exist, but the bug is deterministic and reproducible by anyone with local BPF access. This is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the Linux kernel patch that modifies both macros to correctly handle the dst_reg == src_reg case: adjust JMP_A(1) to JMP_A(2) in the fullsock path and add BPF_MOV64_IMM(si->dst_reg, 0) to zero the register after temp register restoration. Verify the patch against the kernel version used in your environment (see vendor advisory for exact commit hash and affected releases). For interim mitigation, restrict BPF program loading via LSM policies or by disabling unprivileged BPF if your workloads do not require it.

Patch guidance

Check the Linux kernel security advisory and your distribution's kernel update channels for the specific patch version addressing CVE-2026-53078. The fix is typically backported to stable/LTS branches (e.g., linux-6.x.y, linux-5.x.y). Apply patches in order of your release schedule, prioritizing systems where local users can load BPF programs. Verify that both SOCK_OPS_GET_SK and SOCK_OPS_GET_FIELD macro fixes are present in your kernel binary.

Detection guidance

Monitor for attempts to load BPF sock_ops programs using tools like auditd (audit syscall BPF program load events) or eBPF-based runtime security. Kernel logs may show unexpected stack traces or memory access violations in BPF JIT code. Review BPF program audit logs and restrict sock_ops program loading to trusted administrators. During incident response, correlate BPF program load events with kernel oops messages or memory corruption alerts.

Why prioritize this

This is a HIGH-severity local privilege escalation and information disclosure affecting the Linux kernel. It bypasses ASLR, leaks kernel pointers, and corrupts kernel stack—all primitives useful in chaining to full system compromise. While it requires local access and BPF privileges, many production environments (containers, cloud instances, developer machines) enable BPF. Prioritize patching systems where BPF is enabled and unprivileged users exist.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L), Attack Complexity Low (AC:L), Privileges Required Low (PR:L—BPF capability), User Interaction None (UI:N), and high impact on Confidentiality, Integrity, and Availability. The score does not account for real-world prevalence (BPF availability varies) but correctly weights the severity of kernel memory corruption and pointer leaks. Organizations with stricter BPF policies may assess risk lower; those with broad BPF enablement should treat as critical.

Frequently asked questions