Skip to main content

Linux Kernel CVE-2026-53106

| EUVDEUVD-2026-38974 MEDIUM
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-8c24-7wp3-q8gp
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L and PR:L because BPF loading requires local access and low privilege; A:H for CPU deadlock; C:N and I:N confirmed by patch description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:43 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: Do not allow deleting local storage in NMI

Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation requires returning error when irqs_disabled() is true, which, however is too heavy-handed for bpf_xxx_storage_delete().

The long-term solution requires _nolock versions of call_rcu. Another possible solution is to defer the free through irq_work [0], but it would grow the size of selem, which is non-ideal.

The check is only needed in bpf_selem_unlink(), which is used by helpers and syscalls. bpf_selem_unlink_nofail() is fine as it is called during map and owner tear down that never run in NMI or reentrant.

[0] https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com/

AnalysisAI

BPF local storage deletion in the Linux kernel deadlocks when bpf_xxx_storage_delete() helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (kfree_rcu, call_rcu, call_rcu_tasks_trace) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.

Technical ContextAI

BPF local storage maps (per-task, per-cgroup, per-socket) provide key-value storage attached to kernel objects for use by BPF programs. The bpf_selem_unlink() function, which underlies the bpf_xxx_storage_delete() family of helpers, defers element and map freeing through RCU callbacks. In NMI context - which by definition runs with interrupts masked and can interrupt any code including RCU critical sections - invoking these callbacks creates a classic RCU livelock: the NMI handler waits for an RCU grace period that can never complete because the NMI itself interrupted an RCU read-side critical section. CWE-401 (Missing Release of Memory after Effective Lifetime) captures the root class: memory is not released correctly across all execution contexts, manifesting here as a deadlock rather than a simple leak. Affected CPE cpe:2.3:a:linux:linux spans kernels from 5.13 onward; bpf_selem_unlink_nofail() used during map and owner teardown is explicitly noted as safe since those paths never run in NMI.

RemediationAI

Upgrade to Linux kernel 7.0.10 or Linux 7.1, which contain the upstream fix. The authoritative patch commits are e84acaf936970b5b0be2c93bbf255295ba9406df (7.1 stable, https://git.kernel.org/stable/c/e84acaf936970b5b0be2c93bbf255295ba9406df) and 350de5b8a9befaa2a68861c51f671d4f5f751ca5 (7.0.x stable, https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5). Ubuntu users should apply packages from USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). As a compensating control where patching is not immediately possible, setting kernel.unprivileged_bpf_disabled=1 via sysctl prevents unprivileged users from loading BPF programs, eliminating attack surface from non-root users; note this disables legitimate BPF workloads such as eBPF observability tools for unprivileged processes. The patch authors note that a full fix for reentrant IRQ-disabled paths requires _nolock RCU variants not yet available, so the remaining partial risk persists even after the current fix is applied.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53106 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy