CVE-2026-53094

Status: UPDATED  |  Advisory ID: CVE-2026-53094

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stale offload->prog pointer after constant blinding

When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes

JIT compilation with constant blinding enabled (bpf_jit_harden >= 2),

bpf_jit_blind_constants() clones the program. The original prog is then

freed in bpf_jit_prog_release_other(), which updates aux->prog to point

to the surviving clone, but fails to update offload->prog.

This leaves offload->prog pointing to the freed original program. When

the network namespace is subsequently destroyed, cleanup_net() triggers

bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls

__bpf_prog_offload_destroy(offload->prog). Accessing the freed prog

causes a page fault:

BUG: unable to handle page fault for address: ffffc900085f1038

Workqueue: netns cleanup_net

RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80

Call Trace:

__bpf_offload_dev_netdev_unregister+0x257/0x350

bpf_dev_bound_netdev_unregister+0x4a/0x90

unregister_netdevice_many_notify+0x2a2/0x660

...

cleanup_net+0x21a/0x320

The test sequence that triggers this reliably is:

1. Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden)

2. Run xdp_metadata selftest, which creates a dev-bound-only XDP

program on a veth inside a netns (./test_progs -t xdp_metadata)

3. cleanup_net -> page fault in __bpf_prog_offload_destroy

Dev-bound-only programs are unique in that they have an offload structure

but go through the normal JIT path instead of bpf_prog_offload_compile().

This means they are subject to constant blinding's prog clone-and-replace,

while also having offload->prog that must stay in sync.

Fix this by updating offload->prog in bpf_jit_prog_release_other(),

alongside the existing aux->prog update. Both are back-pointers to

the prog that must be kept in sync when the prog is replaced. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References