CVE-2026-53099: Linux Kernel CFI Configuration Regression Disables BPF Destructor Protection

Technical summary

The Linux kernel underwent a compiler-agnostic refactoring of its CFI (Control Flow Integrity) subsystem, renaming CONFIG_CFI_CLANG to CONFIG_CFI in commit 23ef9d439769. However, the BPF subsystem retained references to the old configuration macro name. When a kernel is compiled with the newer CONFIG_CFI option enabled, any code guarded by the legacy CONFIG_CFI_CLANG preprocessor conditional is compiled out. Specifically, CFI type checking for btf_dtor_kfunc_t (BPF Type Format destructor function types) fails to compile in, meaning indirect calls through destructor callbacks in BPF programs bypass CFI validation. An attacker able to influence BPF program execution or load malicious BPF bytecode could potentially redirect control flow through a destructor function pointer without detection.

Business impact

For organizations running Linux systems that rely on BPF-based monitoring, container runtimes, or in-kernel networking policies, this vulnerability undermines a key integrity control. Systems compiled with the correct modern CFI configuration silently lose CFI protection for a specific BPF feature class, leaving them exposed to privilege escalation or code execution attacks via corrupted BPF destructor pointers. The risk is amplified in environments where unprivileged BPF program loading is permitted or where defense-in-depth strategies depend on CFI as a secondary hardening layer.

Affected systems

Linux kernel systems affected by this issue must meet multiple criteria: (1) the kernel was compiled with CONFIG_CFI enabled (not CONFIG_CFI_CLANG), (2) BPF support is compiled in, and (3) BPF programs using destructors (btf_dtor_kfunc_t) are loaded. This primarily impacts recent Linux distributions that have migrated to the new CFI configuration naming scheme, along with any custom-built or embedded Linux deployments using modern kernel sources without backporting the configuration rename fix.

Exploitability

Exploitation requires either the ability to load BPF programs (traditionally a root or CAP_BPF-privileged operation) or to trigger loading of malicious BPF bytecode through a vulnerable application or container runtime. While BPF loading is restricted by default, several attack paths exist: unprivileged BPF in certain configurations, vulnerable user-space daemons with BPF capabilities, or kernel modules that load untrusted BPF. The actual attack surface depends on local system policy and build configuration, but the vulnerability is not exploitable remotely or without local access. CVSS 5.5 (Medium) reflects local-only access requirement and availability impact.

Remediation

Apply a kernel update that corrects all references from CONFIG_CFI_CLANG to CONFIG_CFI within the BPF subsystem, ensuring CFI type checks for btf_dtor_kfunc_t are compiled in when modern CFI configuration is enabled. Additionally, verify your kernel build configuration: if you are using CONFIG_CFI=y, confirm that your kernel source includes the upstream fix and that CFI protection for BPF destructors is actually compiled in (not optimized away).

Patch guidance

Check your Linux distribution's kernel security advisories for an updated kernel package. For custom kernel builds, update your source tree to include the configuration namespace correction and rebuild with CONFIG_CFI enabled. Verify the fix by checking kernel build artifacts or comparing your source against the upstream Linux repository commit that addresses this issue. Distributions that have not yet shipped a corrected kernel should prioritize this update for systems with BPF enabled and CFI hardening configured.

Detection guidance

On affected systems, you can detect the presence of this vulnerability by examining kernel configuration: check if CONFIG_CFI is enabled while CONFIG_CFI_CLANG is not mentioned (indicating a modern build). Cross-reference this with your kernel version and source tree state. Monitor BPF program load events (via audit or eBPF tracing) if unprivileged BPF loading is permitted; anomalous or failed CFI checks would not surface in logs because the protection is absent. Runtime detection of actual exploitation via corrupted destructor pointers is challenging without CFI, making pre-emptive patching critical.

Why prioritize this

Although this is a Medium-severity local vulnerability without KEV tracking, it represents a regression in a critical kernel hardening feature (CFI) that is increasingly deployed on hardened systems. The configuration namespace confusion is easy to miss during distribution builds, potentially affecting numerous systems silently. For organizations that rely on CFI as part of their kernel defense strategy, restoring this protection should be treated as a priority fix despite the lower CVSS score, because the gap leaves BPF programs unprotected against control flow attacks.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector (AV:L) because BPF loading requires local access; low complexity (AC:L) as the vulnerability is a straightforward compilation configuration issue; low privileges (PR:L) since BPF operations traditionally require some privilege (CAP_BPF or root); no user interaction (UI:N); and high availability impact (A:H) from potential system crashes or DoS via corrupted destructor invocations. Confidentiality and integrity are not directly impacted by the missing CFI check itself, though control flow corruption could lead to escalation. The score does not reflect the strategic importance of the defense mechanism being disabled.

Frequently asked questions