Skip to main content

Linux Kernel EUVDEUVD-2026-38949

| CVE-2026-53081 HIGH
Symbolic Name not Mapping to Correct Object (CWE-386)
2026-06-24 Linux GHSA-phj2-v9xx-8m7r
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only verifier bug needing BPF-load privilege (AV:L, PR:L); once loadable the malformed state is deterministic (AC:L); a verifier bypass yields kernel R/W, so C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.4 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:05 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars

When regsafe() compares two scalar registers that both carry BPF_ADD_CONST, check_scalar_ids() maps their full compound id (aka base | BPF_ADD_CONST flag) as one idmap entry. However, it never verifies that the underlying base ids, that is, with the flag stripped are consistent with existing idmap mappings.

This allows construction of two verifier states where the old state has R3 = R2 + 10 (both sharing base id A) while the current state has R3 = R4 + 10 (base id C, unrelated to R2). The idmap creates two independent entries: A->B (for R2) and A|flag->C|flag (for R3), without catching that A->C conflicts with A->B. State pruning then incorrectly succeeds.

Fix this by additionally verifying base ID mapping consistency whenever BPF_ADD_CONST is set: after mapping the compound ids, also invoke check_ids() on the base IDs (flag bits stripped). This ensures that if A was already mapped to B from comparing the source register, any ADD_CONST derivative must also derive from B, not an unrelated C.

AnalysisAI

Local privilege escalation in the Linux kernel (6.11 through pre-patch 6.12.x/6.18.x/7.0.x) arises from a BPF verifier state-pruning flaw in regsafe() handling of BPF_ADD_CONST scalar registers, where base register IDs are not checked for mapping consistency. An attacker able to load BPF programs can construct two verifier states that falsely appear equivalent, causing state pruning to incorrectly succeed and letting an unsafe program bypass verification. With CVSS 7.8 (AV:L/PR:L) and full C/I/A impact, successful exploitation can corrupt kernel memory; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Technical ContextAI

The flaw lives in the Eate BPF (eBPF) in-kernel verifier, specifically the scalar-register comparison logic used during state pruning (regsafe() and check_scalar_ids()). The verifier tracks relationships between registers using ID maps so it can prune equivalent states and bound verification time. When a register value is derived as 'base register + constant', the kernel marks it with the BPF_ADD_CONST flag and stores a compound ID (base ID | flag). The bug is that check_scalar_ids() mapped the full compound ID as a single idmap entry but never validated that the underlying base IDs (flag stripped) were consistent with prior mappings, so a base ID already mapped to B could be silently re-mapped to an unrelated C through its ADD_CONST derivative. This is an incorrect-comparison / state-equivalence root cause (no CWE was assigned in the feed; functionally CWE-697-class), and per the kernel CPE this affects upstream Linux (cpe:2.3:a:linux:linux). The fix additionally calls check_ids() on the stripped base IDs whenever BPF_ADD_CONST is set, ensuring ADD_CONST derivatives must derive from the same already-mapped base.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent containing the stable commits 13c02881…, 691adf73…, 7d73c72c…, or 2f2ec8e7…). Apply the kernel update via your distribution's package manager and reboot, validating the running kernel afterward. Where immediate patching is not possible, the most effective compensating control is to prevent untrusted BPF loading: ensure unprivileged eBPF is disabled by setting sysctl kernel.unprivileged_bpf_disabled=1 (or =2), which blocks non-root users from reaching the vulnerable verifier path - trade-off is that any legitimate unprivileged-BPF tooling will break. Additionally restrict CAP_BPF/CAP_SYS_ADMIN to trusted accounts and avoid granting these capabilities to containers or untrusted workloads (trade-off: may constrain observability/networking tools that require BPF). Reference the kernel stable commits at https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-53081 for the canonical fix.

Same weakness CWE-386 – Symbolic Name not Mapping to Correct Object

View all
CVE-2024-3852 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro 6.2 Affected
SUSE Linux Micro Extras 6.2 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

EUVD-2026-38949 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy