Skip to main content

Linux Kernel EUVDEUVD-2026-38951

| CVE-2026-53083 MEDIUM
2026-06-24 Linux GHSA-xpm3-xhgj-hj4x
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector with low-privilege BPF access required; pure availability impact via RCU stall; no confidentiality or integrity compromise possible.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 18:56 vuln.today
CVSS changed
Jul 23, 2026 - 18:53 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix RCU stall in bpf_fd_array_map_clear()

Add a missing cond_resched() in bpf_fd_array_map_clear() loop.

For PROG_ARRAY maps with many entries this loop calls prog_array_map_poke_run() per entry which can be expensive, and without yielding this can cause RCU stalls under load:

rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 30932 Comm: kworker/0:2 Not tainted 6.14.0-13195-g967e8def1100 #2 PREEMPT(undef) Workqueue: events prog_array_map_clear_deferred RIP: 0010:write_comp_data+0x38/0x90 kernel/kcov.c:246 Call Trace: <TASK> prog_array_map_poke_run+0x77/0x380 kernel/bpf/arraymap.c:1096 __fd_array_map_delete_elem+0x197/0x310 kernel/bpf/arraymap.c:925 bpf_fd_array_map_clear kernel/bpf/arraymap.c:1000 [inline] prog_array_map_clear_deferred+0x119/0x1b0 kernel/bpf/arraymap.c:1141 process_one_work+0x898/0x19d0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x770/0x10b0 kernel/workqueue.c:3400 kthread+0x465/0x880 kernel/kthread.c:464 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x19/0x30 arch/x86/entry/entry_64.S:245 </TASK>

AnalysisAI

RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.

Technical ContextAI

The vulnerability resides in kernel/bpf/arraymap.c within the Linux kernel's eBPF subsystem, introduced at commit da765a2f599304a81a25e77908d1790414ecdbb6. PROG_ARRAY maps are a BPF map type enabling tail-call dispatch between eBPF programs. When such a map is freed, bpf_fd_array_map_clear() iterates all entries and calls prog_array_map_poke_run() per entry to patch jump sites. This poke operation is expensive - involving memory writes under locks - and without a cond_resched() the kernel worker thread (kworker/events) never yields, violating the implicit contract that kernel loops must periodically schedule so the RCU subsystem can complete grace periods. The root cause is a missing scheduler yield point (resource management flaw), not a memory safety or privilege escalation issue. The CWE field was not populated by the reporter, but this maps functionally to CWE-400 (Uncontrolled Resource Consumption) or CWE-835 (Loop with Unreachable Exit Condition under load).

RemediationAI

The primary fix is upgrading to a patched kernel release: Linux 7.1, 7.0.10, 6.18.33, 6.12.91, or 6.6.141, each containing the one-line cond_resched() addition. The stable fix commits are available at https://git.kernel.org/stable/c/b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd, https://git.kernel.org/stable/c/71ddb7defc442ab38c53123c384fedbfd8410a15, https://git.kernel.org/stable/c/e1ed678855e315f90c70c1723e94157a9a82e660, https://git.kernel.org/stable/c/67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a, and https://git.kernel.org/stable/c/4406942e65ca128c56c67443832988873c21d2e9. Ubuntu users should apply the updates referenced in USN-8566-1 through USN-8568-1. As a compensating control prior to patching, setting kernel.unprivileged_bpf_disabled=1 (sysctl) removes BPF map creation capability from unprivileged users, eliminating the attack surface for non-root users; trade-off is that legitimate unprivileged BPF workloads such as some observability tools will break. Environments where BPF is not used at all can disable bpf syscall access via seccomp policy as an alternative hardening layer.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38951 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy