Linux Kernel CVE-2026-53099

The Linux kernel's BPF (Berkeley Packet Filter) subsystem conditionally compiles CFI (Control Flow Integrity) enforcement logic for btf_dtor_kfunc_t - the BPF Type Format destructor kfunc type - gating that code on a kernel configuration symbol. In commit 23ef9d439769 ('kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI'), the option was renamed to be compiler-agnostic, supporting both Clang's CFI and GCC equivalents. The BPF subsystem was not updated to reflect this rename, so the enforcement block still references CONFIG_CFI_CLANG, which is no longer defined, causing the entire CFI protection path to be excluded at compile time. As a result, btf_dtor_kfunc_t CFI violations that the guard was designed to catch and handle gracefully instead go unchecked, potentially triggering undefined kernel behavior or panic. The root cause falls outside standard CWE classification (listed as N/A), but is functionally a missing security control due to a stale compile-time guard. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.