CVE-2026-53106: Linux eBPF Local Storage NMI Deadlock Vulnerability

Technical summary

The vulnerability exists in the eBPF local storage implementation, specifically in the interaction between storage deletion operations and the kernel's memory reclamation mechanisms (kfree_rcu, call_rcu, and call_rcu_tasks_trace). When bpf_xxx_storage_delete() helpers are invoked from NMI context, they can trigger deadlocks because RCU-deferred memory freeing is unsafe in that execution context. The fix adds an NMI detection check in bpf_selem_unlink() that returns an error when a deletion is attempted from NMI, blocking the problematic code path. The fix is narrowly scoped: it applies only to the user-facing deletion helpers and syscalls, not to internal unlink paths used during teardown operations.

Business impact

For organizations running eBPF-based security tools, networking policies, or observability solutions on Linux systems, this vulnerability poses a denial-of-service risk. If malicious or buggy eBPF programs attempt to delete local storage during NMI handling (such as interrupt handlers or watchdog timers), the kernel can deadlock, freezing system responsiveness. The impact is elevated on systems where eBPF programs are loaded from untrusted sources or where strict input validation is absent. Systems running only carefully vetted eBPF code face lower risk, but the vulnerability should still be addressed to prevent accidental triggers.

Affected systems

All Linux kernel versions containing the vulnerable eBPF local storage code are affected. The vulnerability applies to systems that load eBPF programs—particularly those using storage-related BPF helpers. Affected systems include Linux distributions running vulnerable kernel versions that support BPF, with impact concentrated on systems that permit eBPF program loading. The fix was integrated into the kernel after identification, so patch status depends on when your kernel was built relative to the fix merge date.

Exploitability

Exploitability requires the ability to load and execute eBPF programs on the target system, which typically requires CAP_BPF and CAP_PERFMON capabilities or administrative access. An unprivileged user cannot trigger this vulnerability on a standard system. However, in environments where eBPF program loading is permitted to less-privileged users (container orchestration platforms, in-kernel tracing systems with relaxed policies), risk is elevated. The actual trigger—calling a storage deletion helper from NMI context—is not a common legitimate use case, reducing accidental exposure, but remains a valid attack surface if exploited intentionally.

Remediation

Apply kernel patches that include the NMI context check in bpf_selem_unlink(). Verify the fix is present by checking kernel commit history or release notes. Additionally, reduce eBPF program loading permissions to trusted entities only, and audit existing eBPF programs for unintended NMI-context operations. For systems where kernel patching is delayed, consider restricting eBPF capability via LSM policies or disabling unprivileged eBPF if not required for operations.

Patch guidance

Identify your current Linux kernel version and cross-reference it against your distribution's security advisories and kernel release notes for patches addressing CVE-2026-53106. Most major distributions (Red Hat, Debian, Ubuntu, SUSE) will backport this fix to their supported kernel branches. Verify patch inclusion by inspecting kernel commit logs for the bpf_selem_unlink() NMI check, or by running kernel configuration tools that report vulnerability status. Test patches in a staging environment before production deployment to ensure no regression with your eBPF workloads.

Detection guidance

Monitor for kernel deadlock events and NMI watchdog timeouts, particularly if eBPF programs are actively loaded. Kernel logs will show NMI watchdog triggers or soft lockup warnings if the deadlock is triggered. Audit BPF program source code and loaded programs (via bpftool) to identify any that invoke storage deletion helpers, especially those that might be called from interrupt handlers. Implement runtime monitoring of BPF helper invocation patterns to flag suspicious storage operations during sensitive execution contexts.

Why prioritize this

While CVE-2026-53106 carries a CVSS score of 5.5 (medium severity), it warrants prioritization because deadlock vulnerabilities can severely impact system availability and are difficult to diagnose post-incident. The narrow exploit preconditions (requiring BPF loading capability) mean that not all systems are equally at risk, but those running permissive eBPF policies should treat this as high-priority. Organizations with BPF-heavy observability or security stacks should prioritize patch deployment to avoid production availability events.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector, low privileges required, and high impact on availability (denial of service via system deadlock), but no impact on confidentiality or integrity. The score appropriately captures the severity of a deadlock but does not amplify it because exploitation requires BPF loading permissions. In environments where BPF program loading is highly restricted, actual risk may be lower; in permissive environments, the functional impact of a deadlock may warrant treating this with greater urgency despite the medium CVSS rating.

Frequently asked questions