Linux Kernel CVE-2026-52938

Exploitation requires the following specific conditions: (1) the target system must have BPF socket storage in use - a BPF program must have previously called bpf_sk_storage_get() to attach a storage element to a socket; (2) the attacker must have the ability to load BPF programs, which on default Linux configurations requires either root/CAP_BPF or kernel.unprivileged_bpf_disabled=0 (the permissive default on many distributions); (3) the race window requires concurrent execution of bpf_selem_unlink_nofail() and bpf_sk_storage_clone() or bpf_sk_storage_diag_put_all() - the latter is reachable via TCP SYN handling during socket cloning. Systems that do not run any BPF programs using bpf_sk_storage maps are not affected regardless of kernel version. Setting kernel.unprivileged_bpf_disabled=1 removes the low-privilege trigger path, limiting exploitation to root or CAP_BPF holders.

Real-world risk is low-to-moderate for the vast majority of deployments. The CVSS 5.5 (Medium) with AV:L/PR:L correctly scopes this as a local, low-privilege issue - exploitation requires the ability to load BPF programs and create socket storage maps, which is restricted by default on hardened systems (kernel.unprivileged_bpf_disabled=1). EPSS at 0.14% (4th percentile) aligns with the absence of any KEV listing or known POC, suggesting this has not been observed in active campaigns. The race condition nature introduces real-world timing complexity beyond what AC:L (the provided score) suggests; independent assessment rates AC:H. Impact is strictly availability (kernel panic - A:H), with no confidentiality or integrity exposure. The indirect trigger via TCP SYN handling means that a malicious local actor with BPF privileges could potentially crash a network-facing server by combining BPF socket storage map creation with inbound TCP traffic, but this requires controlled conditions. Priority is appropriate for kernel maintenance cycles rather than emergency response for most organizations, except those running BPF-intensive workloads or multi-tenant Linux environments where local access is broadly granted.

A local user with low privileges (or CAP_BPF) on a system with unprivileged BPF enabled creates a BPF socket storage map and attaches a storage element to an active TCP socket. A concurrent thread or network event triggers socket cloning via an inbound TCP SYN (exercising tcp_v4_syn_recv_sock → bpf_sk_storage_clone), racing with the selem unlink that has already nulled smap but not yet removed the element from the hlist. The RCU reader dereferences the NULL smap pointer, producing a general protection fault and crashing the kernel. No public proof-of-concept is known at time of analysis.