CVE-2026-53096 bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
A race condition in the Linux kernel BPF dev_map allows attackers to cause denial of service or potentially execute code via improper RCU iteration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53096?
CVE-2026-53096 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
The DEVMAP_HASH branch in dev_map_redirect_multi() uses hlist_for_each_entry_safe() to iterate hash buckets, but this function runs under RCU protection (called from xdp_do_generic_redirect_map() in softirq context). Concurrent writers (__dev_map_hash_update_elem, dev_map_hash_delete_elem) modify the list using RCU primitives (hlist_add_head_rcu, hlist_del_rcu).
hlist_for_each_entry_safe() performs plain pointer dereferences without rcu_dereference(), missing the acquire barrier needed to pair with writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64, POWER), a reader can observe a partially-constructed node. It also defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race detection.
Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held() as the lockdep condition, consistent with the rcu_dereference_check() used in the DEVMAP (non-hash) branch of the same functions. Also fix the same incorrect lockdep_is_held(&dtab->index_lock) condition in dev_map_enqueue_multi(), where the lock is not held either.
Which versions are affected by CVE-2026-53096?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53096?
Apply the vendor's patch.
Is CVE-2026-53096 being exploited?
There is no known exploitation of CVE-2026-53096 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53096, DEBIAN-CVE-2026-53096, GHSA-8qvr-6896-8wfm, ROOT-OS-DEBIAN-12-CVE-2026-53096, ROOT-OS-UBUNTU-2204-CVE-2026-53096, ROOT-OS-UBUNTU-2404-CVE-2026-53096 and 1 more.