CVE-2026-53090: Linux Kernel eBPF Verifier Subprogram Logic Flaw (CVSS 7.8)

Technical summary

The Linux kernel's eBPF verifier contains a logic error in its handling of ld_abs and ld_ind instructions within subprograms. These legacy packet-loading instructions have two execution paths: a success path (returning packet data in r0) and a failure path (setting r0=0 and returning to caller). While the verifier enforces that ld_abs/ld_ind in subprograms must have scalar return types, it fails to simulate the abnormal exit path during verification. The fix requires the verifier to analyze both the success path (pushing it onto the stack for deferred validation) and the failure path (r0=0, return), similar to how tail-call verification is performed. The bug allows a malicious or malformed eBPF program to evade the intended control-flow and type-safety checks.

Business impact

This vulnerability affects Linux systems that load untrusted eBPF programs—typically container platforms, in-kernel packet filtering solutions, and security monitoring tools using eBPF. An unprivileged local attacker with capability to load eBPF programs could escalate privileges, read or modify kernel memory, or cause denial of service. Organizations running container workloads, Kubernetes clusters, or custom eBPF-based security tools should prioritize patching. The impact is limited to local attacks and requires the ability to invoke the eBPF loader, reducing the exposure surface compared to remote vulnerabilities, but the consequence of compromise is severe.

Affected systems

All Linux kernel versions that include the ld_abs/ld_ind subprogram extension (introduced via commit 09b28d76eac4). This affects mainline kernels and stable branches that backported the feature. Specific patched versions and affected ranges must be verified against the official Linux kernel security advisory and your distribution's advisory channels. Distributions including Ubuntu, Debian, Red Hat, and others shipping recent kernel versions are likely affected.

Exploitability

The vulnerability requires local access and the ability to load eBPF programs into the kernel, which is typically restricted to privileged processes or containers with explicit eBPF capabilities. Exploitation does not require a network vector and is not trivial—the attacker must craft a malicious eBPF program that leverages the unvalidated failure path to breach isolation guarantees. The issue is not currently tracked in the CISA KEV catalog, suggesting no active exploitation in the wild at the time of publication. However, the logic flaw is well-defined and could be weaponized once publicly disclosed.

Remediation

Apply the kernel patch that corrects the eBPF verifier's path analysis for ld_abs/ld_ind in subprograms. The fix ensures the verifier simulates both success and failure paths, matching the intended control flow and return-type guarantees. Consult your Linux distribution's security advisory for specific patched kernel versions and deployment timelines. Systems should prioritize updates if they run untrusted workloads or expose eBPF program loading to less-privileged users.

Patch guidance

Obtain and apply the corrected Linux kernel package from your distribution's official security repository. The fix is targeted and surgical, modifying the verifier's instruction analysis logic without affecting eBPF program performance or the ld_abs/ld_ind instruction semantics for correct programs. Verify the patch commit hash against the upstream kernel repository (kernel.org) and your distribution advisory to ensure authenticity. After patching, reboot systems running affected kernel versions. For containerized environments, update the host kernel and ensure container runtimes enforce eBPF load restrictions via appropriate seccomp and AppArmor/SELinux policies.

Detection guidance

Monitor kernel logs and eBPF verifier errors for anomalous eBPF program rejections or unexpected success of programs that should fail validation. Track unsuccessful eBPF program loads that correlate with privilege-escalation attempts or unauthorized memory access. On systems with auditd enabled, log eBPF program loads (audit rule: -a always,exit -F arch=x86_64 -S bpf -F auid>=1000) and review for suspicious patterns. Container environments should implement admission controllers (e.g., Kubernetes policies) to prevent untrusted eBPF program loading. Deep inspection of eBPF bytecode for ld_abs/ld_ind usage in subprograms can identify potentially malicious constructs, though this requires specialized tooling.

Why prioritize this

This is a HIGH severity vulnerability affecting a critical kernel subsystem (eBPF verifier) with a CVSS score of 7.8. While exploitation requires local access and elevated privileges, successful attacks lead to complete privilege escalation and kernel memory corruption. Organizations running Kubernetes, container platforms, or custom eBPF-based security tools should patch promptly, particularly if their threat model includes compromise of workload or host-level processes with eBPF loading capability. The absence of public exploits should not lower urgency, as the flaw is logic-based and discoverable.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (no network exposure), low privilege requirement (but not unauthenticated), high impact on confidentiality, integrity, and availability (kernel memory read/write, process termination), and no user interaction. The score appropriately captures the severity of a kernel memory safety violation, tempered by the local-access and privilege requirements that limit immediate blast radius in many environments.

Frequently asked questions