Skip to main content

Linux Kernel CVE-2026-53076

| EUVDEUVD-2026-38944 HIGH
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-645x-23wh-rhvm
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local trigger via the bpf() syscall (AV:L) with low complexity, but requires BPF map-creation privilege (PR:L); OOB read leaks kernel memory (C:H) and can crash the host (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:04 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix OOB in pcpu_init_value

An out-of-bounds read occurs when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes.

The issue happens when:

  1. A CGROUP_STORAGE map is created with value_size not aligned to

8 bytes (e.g., 4 bytes)

  1. A pcpu map is created with the same value_size (e.g., 4 bytes)
  2. Update element in 2 with data in 1

pcpu_init_value assumes that all sources are rounded up to 8 bytes, and invokes copy_map_value_long to make a data copy, However, the assumption doesn't stand since there are some cases where the source may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data. the verifier verifies exactly the size that the source claims, not the size rounded up to 8 bytes by kernel, an OOB happens when the source has only 4 bytes while the copy size(4) is rounded up to 8.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's eBPF subsystem (pcpu_init_value) lets a local, low-privileged user with BPF access leak adjacent kernel memory and potentially crash the system. The flaw triggers when a per-CPU map is updated from a BPF_MAP_TYPE_CGROUP_STORAGE map whose value_size is not 8-byte aligned (e.g. 4 bytes), causing copy_map_value_long to read past the true source size. The issue is fixed in stable kernels; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.16%, 5th percentile).

Technical ContextAI

The vulnerability lives in the kernel's eBPF map machinery, specifically pcpu_init_value(), which initializes per-CPU (percpu) BPF map values. That routine assumes every source value buffer has been rounded up to an 8-byte boundary and therefore uses copy_map_value_long() for the copy. However, certain BPF value sources - notably BPF_MAP_TYPE_CGROUP_STORAGE and skb->data - are sized to exactly the value_size the verifier checked, not the kernel's 8-byte-rounded size. When value_size is 4 bytes, the long/8-byte-granularity copy reads 4 bytes beyond the genuine source allocation, producing an out-of-bounds read. The root cause class is CWE-125 (Out-of-bounds Read); although the upstream CWE field is marked N/A, the intelligence tags ('Buffer Overflow') and the description confirm a memory-safety read overflow. The affected component is part of the core kernel (CPE cpe:2.3:a:linux:linux), so the technology is the mainline/stable Linux kernel BPF allocator and copy helpers rather than any third-party module.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later on the matching branch), or apply your distribution's backport of the corresponding fix commits (e19c5ed9f192 / e0378419b0e2 / 6086079e6d1c / 634a793d0e1c / 576afddfee8d) referenced at https://git.kernel.org/stable/c/. Track your distro's security advisory and rebuild/reboot into the patched kernel. If immediate patching is not possible, the most effective compensating control is to restrict who can load BPF programs and create maps: set the sysctl kernel.unprivileged_bpf_disabled=1 (or =2) to block unprivileged BPF, which closes the exposure for non-CAP_BPF users at the cost of breaking any unprivileged BPF tooling you rely on. On container hosts, drop CAP_BPF/CAP_SYS_ADMIN from untrusted workloads and apply a seccomp profile blocking the bpf() syscall - this prevents the trigger but will disable in-container observability/eBPF features. These controls reduce, but do not eliminate, risk for legitimately privileged BPF users, so patching remains the durable fix; cite https://nvd.nist.gov/vuln/detail/CVE-2026-53076 for tracking.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53076 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy