Skip to main content

Linux Kernel EUVDEUVD-2026-38899

| CVE-2026-53031 HIGH
2026-06-24 Linux GHSA-qf6r-crjw-4c6m
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local trigger via BPF requires privileges to load programs (PR:L) but no user interaction; unchecked node_id causes kernel OOB with high C/I/A and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:53 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Validate node_id in arena_alloc_pages()

arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in arena_alloc_pages().

AnalysisAI

Memory corruption in the Linux kernel BPF arena subsystem (versions 6.9 through pre-patch 7.1) arises because arena_alloc_pages() accepts an attacker-controlled NUMA node_id as a plain int and forwards it through the entire page-allocation chain without bounds validation. A local user able to load BPF programs and invoke the bpf_arena_alloc_pages helper can supply an out-of-range node_id, leading to out-of-bounds access into per-node allocator structures with potential information disclosure, corruption, or denial of service. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.17%, 6th percentile).

Technical ContextAI

BPF arena is a sparse, shared memory region mapped between the kernel and BPF programs, allowing JIT-compiled BPF code to allocate and address pages directly. The kernel-side helper arena_alloc_pages() is the backend for the bpf_arena_alloc_pages() program helper; it takes a node_id (intended to be a NUMA node identifier) and passes it down to the page allocator (e.g. alloc_pages_node and friends) which index NUMA node arrays by that id. Because the value was carried as an unchecked int, an out-of-bounds or negative node_id reaches code that assumes a valid node, producing out-of-bounds array indexing. The root cause is improper input validation / improper validation of an array index (CWE-20 / CWE-129); the NVD/CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the upstream Linux kernel, with the fix adding an explicit node_id bounds check before the allocation chain.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's patched build incorporating commits 31d3b4b28e55..., e15900888c09..., fb66e20130f9..., or 2845989f2eba...). Apply the relevant stable commit from https://git.kernel.org/stable/c/31d3b4b28e55835646d6829d60023f730dd34e85 if backporting manually. Until patched, the most effective compensating control is to deny attackers the ability to load BPF programs: ensure unprivileged BPF is disabled by setting sysctl kernel.unprivileged_bpf_disabled=1 (default on many hardened distros; side effect: breaks any unprivileged-BPF workloads), and restrict CAP_BPF/CAP_PERFMON/CAP_SYS_ADMIN to trusted users and containers (side effect: may impact observability/eBPF tooling that legitimately needs those capabilities). On systems that do not require BPF arena, avoiding workloads that use bpf_arena_alloc_pages further reduces exposure. Refer to the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53031 and vuldb entry https://vuldb.com/vuln/373426.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy