Linux Kernel CVE-2026-53095

The Linux kernel's eBPF subsystem supports program types including kprobe (kernel function probing) and freplace (function replacement/trampolining). A key design distinction is that uprobe-type BPF programs - which target user-space processes - are permitted to write back to struct pt_regs (CPU register state) via the kprobe_write_ctx=true flag, because modifying user-space register context is safe and expected. The vulnerability arises from a type-confusion path: internally, uprobe programs use the KPROBE program type. An attacker can load a kprobe program with kprobe_write_ctx=true attached to a kernel function, then load a freplace (function replacement) program that attaches to that kprobe program. The freplace program inherits the write-context permission and can freely modify struct pt_regs fields (e.g., regs->di, the first argument register on x86-64), corrupting the arguments seen by the probed kernel function at runtime. The fix adds an enforcement check that prevents freplace programs from attaching to kprobe programs when their kprobe_write_ctx values differ, closing the privilege escalation path. Affected CPE: cpe:2.3:a:linux:linux.