Skip to main content

Linux Kernel EUVDEUVD-2026-38978

| CVE-2026-53110 HIGH
2026-06-24 Linux GHSA-j2v8-v4c8-53mp
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local s390x host with BPF-load capability gives PR:L/AV:L; crafting the triggering program is straightforward (AC:L); JIT miscompilation can disclose kernel memory and corrupt kernel state, so C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:12 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/bpf: Zero-extend bpf prog return values and kfunc arguments

s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values.

s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.

AnalysisAI

Memory-safety and information-disclosure risk in the Linux kernel s390 (IBM Z) eBPF JIT compiler stems from incomplete ABI compliance: the JIT sign-extended values but never zero-extended unsigned BPF program return values and kfunc arguments as the s390x calling convention requires. On s390x hosts, a local user able to load BPF programs can cause the JIT to emit code that leaves stale upper register bits, producing incorrect computation that can leak kernel data or corrupt execution. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not in CISA KEV; it is fixed in multiple stable releases.

Technical ContextAI

The affected technology is the s390x (IBM Z mainframe) back end of the kernel's eBPF Just-In-Time compiler, which translates verified BPF bytecode into native machine instructions. The s390x ABI mandates that callers zero-extend unsigned arguments / sign-extend signed arguments and that callees zero-extend unsigned return values / sign-extend signed return values. The s390 BPF JIT implemented only the sign-extension half of this contract, so unsigned return values from BPF programs and unsigned kfunc arguments were left with undefined high-order bits. CPE data (cpe:2.3:a:linux:linux) identifies the generic Linux kernel as the affected product, but the defective code path is architecture-specific to s390. The CWE is not assigned by NVD; the behavior maps conceptually to an ABI/type-handling defect (incorrect calculation / improper conversion) that the vendor tags as Information Disclosure.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.141, 6.12.91, 6.18.33, 7.0.10 or 7.1, or apply the corresponding distribution backport, then reboot so the patched s390 BPF JIT takes effect; the upstream fixes are the kernel.org stable commits edc90a12073b, 44c4f999b03f, 366b0e05ee24, 834918a77be5 and 202e42e4aa89 (advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-53110). Where immediate patching of s390x hosts is not possible, the most effective compensating control is to deny the ability to load BPF programs: set kernel.unprivileged_bpf_disabled=1 (or =2) via sysctl to block unprivileged BPF, and restrict CAP_BPF/CAP_SYS_ADMIN so only trusted workloads can load programs - the trade-off is that legitimate BPF-based observability, networking, or security tooling on those hosts will stop loading new programs. Disabling the BPF JIT (net.core.bpf_jit_enable=0) avoids the miscompilation entirely but forces interpreter execution with a performance cost and is not a substitute for patching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38978 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy