CVE-2026-53110: Linux s390x BPF JIT Zero-Extension Flaw – Local Privilege Escalation

Technical summary

The s390x ABI specifies that unsigned integers must be zero-extended and signed integers must be sign-extended both when passed as arguments to functions and when returned from functions. The BPF JIT compiler on s390 implements sign-extension correctly but omits zero-extension logic. When an unsigned value is returned from a BPF program or passed as an argument to a kernel function (kfunc), the high-order bits may contain stale data instead of being zeroed. This violates the calling convention and can cause the kernel to misinterpret the value, potentially corrupting memory structures or bypassing security checks that depend on precise value boundaries. The vulnerability affects any BPF program loaded on s390x systems that returns unsigned values or calls kernel functions with unsigned parameters.

Business impact

Organizations deploying IBM System z mainframes running Linux with BPF-enabled kernels face a local privilege escalation risk. An attacker with unprivileged user access can load malicious BPF programs that exploit the zero-extension gap to corrupt kernel memory, escalate privileges, or crash the system. This is particularly concerning in multi-tenant or cloud environments where BPF capabilities might be exposed to containers or untrusted workloads. The severity is heightened because BPF is increasingly used in observability, networking, and security tooling; a flaw in the JIT can undermine the reliability of these critical functions.

Affected systems

Linux kernel on s390x (IBM System z) architecture with BPF JIT enabled. The vulnerability is present in the kernel's arch/s390/net/bpf_jit_comp.c implementation. Any s390x system running a vulnerable kernel version and permitting BPF program loading (via bpf() syscall or eBPF capabilities) is affected. This includes mainframe Linux distributions and z/VM guests running Linux.

Exploitability

Exploitation requires local system access and the ability to load BPF programs (typically requiring CAP_BPF or CAP_SYS_ADMIN capability). The attacker would craft a BPF program that returns an unsigned value or invokes a kfunc with unsigned arguments, triggering the zero-extension flaw to corrupt a kernel data structure or bypass a security boundary. The attack surface is limited to privileged or capability-bearing users, but in containerized or cloud environments, that boundary may be lower than on traditional systems. No public exploit code is known at this time.

Remediation

Apply a kernel patch that implements proper zero-extension logic in the s390 BPF JIT compiler. The fix ensures that unsigned return values and unsigned function arguments are zero-extended according to the s390x ABI. Verify the patch is merged into your kernel version and recompile or update the kernel package.

Patch guidance

Consult your Linux distribution's security advisories and kernel update mechanism for the patched version. Mainframe distributions (Red Hat Enterprise Linux for z, SUSE Linux Enterprise Server for z) will provide kernel packages with the fix integrated. Verify against the vendor advisory that the specific kernel version you are running includes the commit that resolves the s390 BPF JIT zero-extension logic. Reboot to activate the patched kernel.

Detection guidance

Monitor for unexpected kernel crashes or memory corruption warnings on s390x systems with BPF enabled. Audit BPF program loading via auditd or eBPF monitoring tools to identify unusual program activity. Check kernel logs for signs of memory protections being triggered (e.g., KASAN, kmemleak alerts) which may indicate exploitation attempts. Review BPF program sources for suspicious unsigned return values or unsigned kfunc calls if you have kernel module or eBPF source visibility.

Why prioritize this

This vulnerability merits high priority remediation due to its CVSS 7.8 (HIGH) severity, local privilege escalation potential, and direct impact on memory safety. Although it requires local access, the consequence is complete system compromise. s390x systems in regulated industries (banking, government) or supporting critical infrastructure should be patched urgently. Organizations running untrusted BPF programs or multi-tenant Linux on z environments should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity: the attack vector is Local (user-level access required), the complexity is Low (no special conditions), privilege escalation is needed (PR:L—CAP_BPF or CAP_SYS_ADMIN), user interaction is not required, scope is Unchanged, and the impact is High across Confidentiality, Integrity, and Availability. The score accurately reflects that this is a privilege-escalation flaw with severe kernel memory impact, offset only by the local-access requirement.

Frequently asked questions