Skip to main content

Linux Kernel EUVDEUVD-2026-38951

| CVE-2026-53083 MEDIUM
2026-06-24 Linux GHSA-xpm3-xhgj-hj4x
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local access with CAP_BPF
  2. Delivery
    Create large PROG_ARRAY BPF map
  3. Exploit
    Populate map with many program entries
  4. Install
    Release map to trigger deferred clear
  5. C2
    Worker loop spins without CPU yield
  6. Execute
    RCU grace period starved
  7. Impact
    Kernel stall degrades availability

Vulnerability Assessment

Exploitation Conditions

Exploitation requires a local session on the target system with CAP_BPF capability (or CAP_SYS_ADMIN on kernels predating the capability split), which is not granted to unprivileged users by default. The attacker must be able to create a BPF PROG_ARRAY map, populate it with a large number of valid program entries, and trigger the map's deferred clear path - either by closing the last file descriptor referencing the map or by explicit deletion. The stall manifests in the kworker/events workqueue thread, not the attacker's own process, making the timing of impact non-deterministic. Systems where kernel.unprivileged_bpf_disabled=1 is set are not exploitable by non-root users. The 'Information Disclosure' tag in source intelligence is inconsistent with the actual impact and should not be treated as an exploitation condition.
Impact

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects a local, low-complexity, low-privilege availability-only impact. The EPSS score of 0.16% at the 5th percentile reinforces that automated or widespread exploitation is extremely unlikely. No CISA KEV listing and no public exploit code further confirm this is not being weaponized. The real-world risk is therefore low despite the kernel-level nature of the fault: an attacker must already have local access and BPF map creation privileges (typically requiring CAP_BPF or root), and the impact is a kernel RCU stall warning and potential transient system instability rather than code execution or data exfiltration. The input tags include 'Information Disclosure,' which is inconsistent with the CVSS vector (C:N/I:N) and the description - this tag appears erroneous and should not influence risk decisions. Patching is recommended on normal maintenance cadence, not emergency response.
Exploit ScenarioDerived

A local user with CAP_BPF or equivalent privilege allocates a PROG_ARRAY BPF map populated with a large number of program file descriptors, then releases the map, triggering prog_array_map_clear_deferred in the kernel workqueue. The worker iterates all entries calling prog_array_map_poke_run() without yielding, causing the RCU grace period to time out and generating RCU stall warnings that degrade kernel responsiveness or trigger a kernel panic on configurations with panic_on_rcu_stall enabled. No public exploit code is identified at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.

RemediationAI

The primary fix is upgrading to a patched kernel release: Linux 7.1, 7.0.10, 6.18.33, 6.12.91, or 6.6.141, each containing the one-line cond_resched() addition. The stable fix commits are available at https://git.kernel.org/stable/c/b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd, https://git.kernel.org/stable/c/71ddb7defc442ab38c53123c384fedbfd8410a15, https://git.kernel.org/stable/c/e1ed678855e315f90c70c1723e94157a9a82e660, https://git.kernel.org/stable/c/67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a, and https://git.kernel.org/stable/c/4406942e65ca128c56c67443832988873c21d2e9. Ubuntu users should apply the updates referenced in USN-8566-1 through USN-8568-1. As a compensating control prior to patching, setting kernel.unprivileged_bpf_disabled=1 (sysctl) removes BPF map creation capability from unprivileged users, eliminating the attack surface for non-root users; trade-off is that legitimate unprivileged BPF workloads such as some observability tools will break. Environments where BPF is not used at all can disable bpf syscall access via seccomp policy as an alternative hardening layer.

Affected VersionsENISA

Linux 5.5
Linux patch: 7.1
Linux patch: 6.12.91
Linux da765a2f599304a81a25e77908d1790414ecdbb6 <e1ed678855e315f90c70c1723e94157a9a82e660
Linux da765a2f599304a81a25e77908d1790414ecdbb6 <67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a
Linux da765a2f599304a81a25e77908d1790414ecdbb6 <b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd
Linux patch: 0
Linux da765a2f599304a81a25e77908d1790414ecdbb6 <4406942e65ca128c56c67443832988873c21d2e9
Linux patch: 7.0.10
Linux da765a2f599304a81a25e77908d1790414ecdbb6 <71ddb7defc442ab38c53123c384fedbfd8410a15
Linux patch: 6.18.33
Linux patch: 6.6.141

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in kernel/bpf/arraymap.c within the Linux kernel's eBPF subsystem, introduced at commit da765a2f599304a81a25e77908d1790414ecdbb6. PROG_ARRAY maps are a BPF map type enabling tail-call dispatch between eBPF programs. When such a map is freed, bpf_fd_array_map_clear() iterates all entries and calls prog_array_map_poke_run() per entry to patch jump sites. This poke operation is expensive - involving memory writes under locks - and without a cond_resched() the kernel worker thread (kworker/events) never yields, violating the implicit contract that kernel loops must periodically schedule so the RCU subsystem can complete grace periods. The root cause is a missing scheduler yield point (resource management flaw), not a memory safety or privilege escalation issue. The CWE field was not populated by the reporter, but this maps functionally to CWE-400 (Uncontrolled Resource Consumption) or CWE-835 (Loop with Unreachable Exit Condition under load).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local vector with low-privilege BPF access required; pure availability impact via RCU stall; no confidentiality or integrity compromise possible.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 18:53 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix RCU stall in bpf_fd_array_map_clear()

Add a missing cond_resched() in bpf_fd_array_map_clear() loop.

For PROG_ARRAY maps with many entries this loop calls prog_array_map_poke_run() per entry which can be expensive, and without yielding this can cause RCU stalls under load:

rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 30932 Comm: kworker/0:2 Not tainted 6.14.0-13195-g967e8def1100 #2 PREEMPT(undef) Workqueue: events prog_array_map_clear_deferred RIP: 0010:write_comp_data+0x38/0x90 kernel/kcov.c:246 Call Trace: <TASK> prog_array_map_poke_run+0x77/0x380 kernel/bpf/arraymap.c:1096 __fd_array_map_delete_elem+0x197/0x310 kernel/bpf/arraymap.c:925 bpf_fd_array_map_clear kernel/bpf/arraymap.c:1000 [inline] prog_array_map_clear_deferred+0x119/0x1b0 kernel/bpf/arraymap.c:1141 process_one_work+0x898/0x19d0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x770/0x10b0 kernel/workqueue.c:3400 kthread+0x465/0x880 kernel/kthread.c:464 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x19/0x30 arch/x86/entry/entry_64.S:245 </TASK>

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
core OS kernel powering most Linux and Android deployments worldwide
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53083 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373443 REF https://git.kernel.org/stable/c/419878a48085e6d5c2fcc4912eeaac2f8abf36ed REF https://git.kernel.org/stable/c/4406942e65ca128c56c67443832988873c21d2e9 REF https://git.kernel.org/stable/c/67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a REF https://git.kernel.org/stable/c/71ddb7defc442ab38c53123c384fedbfd8410a15 REF https://git.kernel.org/stable/c/b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd REF https://git.kernel.org/stable/c/e1ed678855e315f90c70c1723e94157a9a82e660

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy