CVE-2026-53106 bpf: Do not allow deleting local storage in NMI
A local attacker can cause a kernel deadlock and denial of service by triggering BPF local storage deletion within a Non-Maskable Interrupt context.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53106?
CVE-2026-53106 is a medium-severity denial of service vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Do not allow deleting local storage in NMI
Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation requires returning error when irqs_disabled() is true, which, however is too heavy-handed for bpf_xxx_storage_delete().
The long-term solution requires _nolock versions of call_rcu. Another possible solution is to defer the free through irq_work [0], but it would grow the size of selem, which is non-ideal.
The check is only needed in bpf_selem_unlink(), which is used by helpers and syscalls. bpf_selem_unlink_nofail() is fine as it is called during map and owner tear down that never run in NMI or reentrant.
[0] https://lore.kernel.org/bpf/[email protected]/
Weakness: CWE-401
Which versions are affected by CVE-2026-53106?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53106?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53106 being exploited?
There is no known exploitation of CVE-2026-53106 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90759, BELL-CVE-2026-53106, DEBIAN-CVE-2026-53106, GHSA-8c24-7wp3-q8gp, ROOT-OS-DEBIAN-12-CVE-2026-53106, ROOT-OS-DEBIAN-13-CVE-2026-53106 and 3 more.