Linux Kernel CVE-2026-53096

The bug lives in the kernel's eBPF XDP redirect subsystem, specifically the BPF_MAP_TYPE_DEVMAP_HASH map used by xdp_do_generic_redirect_map() to fan out (broadcast/multicast redirect) packets to multiple net devices. Devmap-hash buckets are RCU-protected lists: writers (__dev_map_hash_update_elem, dev_map_hash_delete_elem) mutate them with hlist_add_head_rcu()/hlist_del_rcu() and rcu_assign_pointer(), which emit a release barrier. The faulty reader iterated those buckets with hlist_for_each_entry_safe(), which performs plain pointer loads with no rcu_dereference() and therefore no paired acquire barrier. On weakly-ordered CPUs the node contents can be read before the writer's stores are visible, yielding a torn/partially-initialized object. The root cause is an RCU list-traversal / data-race class of bug (analogous to CWE-362 race condition and CWE-416-style use of inconsistently-published memory); the CWE field is N/A in the source data. The fix swaps in hlist_for_each_entry_rcu() with rcu_read_lock_bh_held() as the lockdep condition (matching the non-hash DEVMAP branch) and also corrects a bogus lockdep_is_held(&dtab->index_lock) assertion in dev_map_enqueue_multi() where that lock is not actually held. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux:*.