CVE-2026-53092 bpf: Fix linked reg delta tracking when src_reg == dst_reg
A logic error in the Linux kernel BPF verifier allows incorrect delta tracking, potentially leading to verifier bypass and arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53092?
CVE-2026-53092 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix linked reg delta tracking when src_reg == dst_reg
Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source.
This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.
Weakness: CWE-393
Which versions are affected by CVE-2026-53092?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53092?
Apply the vendor's patch.
Is CVE-2026-53092 being exploited?
There is no known exploitation of CVE-2026-53092 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53092, DEBIAN-CVE-2026-53092, GHSA-4p37-9v73-jm8h, ROOT-OS-DEBIAN-13-CVE-2026-53092, UBUNTU-CVE-2026-53092.