Look up another CVE · open CVE-2026-53096 in the interactive tracker
CVE-2026-53096
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem kernel/bpf. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53096 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The DEVMAP_HASH branch in dev_map_redirect_multi() uses hlist_for_each_entry_safe() to iterate hash buckets, but this function runs under RCU protection (called from xdp_do_generic_redirect_map() in softirq context). Concurrent writers (__dev_map_hash_update_elem, dev_map_hash_delete_elem) modify the list using RCU primitives (hlist_add_head_rcu, hlist_del_rcu). hlist_for_each_entry_safe() performs plain pointer dereferences without rcu_dereference(), missing the acquire barrier needed to pair with writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64, POWER), a reader can observe a partially-constructed node. It also defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race detection. Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held() as the lockdep condition, consistent with the rcu_dereference_check() used in the DEVMAP (non-hash) branch of the same functions. Also fix the same incorrect lockdep_is_held(&dtab->index_lock) condition in dev_map_enqueue_multi(), where the lock is not held either.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/bpf/devmap.c
- What this is
- XDP (eXpress Data Path)MAINTAINERS section matched on kernel/bpf/devmap.c · netdev@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_BPF|CONFIG_BPF_SYSCALL|CONFIG_NET' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_NET
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel/bpf
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.14 | 5.15.209 | 4a3d0fe30b90 |
| 5.14 | 6.1.175 | b089aa6e94d7 |
| 5.14 | 6.6.141 | 571a05ea1baa |
| 5.14 | 6.12.91 | cb2c1f3cf65b |
| 5.14 | 6.18.33 | d4c4bd231eba |
| 5.14 | 7.0.10 | 7027e7050624 |
| 5.14 | 7.1 | 8ed82f807bb0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path requires local BPF/netlink setup of an XDP program using a DEVMAP_HASH broadcast redirect and concurrent map update/delete operations. Network packets can trigger the packet-side reader after setup, but the exploit control path is local.
- AC:LAttack complexity, low
- The attacker can control both sides of the race by driving packets through the attached XDP program while another local thread updates or deletes devmap-hash entries. Weakly ordered architectures such as ARM64/POWER are common reasonable deployments, so this is not a rare external condition.
- PR:LPrivileges required, low
- The path requires BPF/CAP_NET_ADMIN-style privileges to create/update the map and load/attach XDP, but these can be available to a low-privileged local attacker through namespace/delegated BPF-token scenarios. It is not reachable by an unauthenticated remote attacker.
- UI:NUser interaction, none
- No victim action is needed once the attacker has the local privileges and can run the racing BPF/map operations. Packet delivery and map syscalls are attacker-driven.
- S:UScope, unchanged
- The impact remains within the kernel and the network namespace/security authority being attacked. This is standard kernel memory-safety exposure, not a VM escape or separate-scope boundary bypass.
- C:HConfidentiality impact, high
- The unsafe non-RCU traversal can observe partially constructed or inconsistent bpf_dtab_netdev objects and dereference attacker-influenced stale kernel pointers. Given the kernel pointer misuse and heap-shaping potential, high confidentiality impact is defensible.
- I:HIntegrity impact, high
- The same stale or partially initialized dev/xdp_prog pointers can be used in redirect and BPF program execution paths, making control-flow or object-confusion style corruption plausible. Under the required overestimate rule, this supports high integrity impact.
- A:HAvailability impact, high
- At minimum, dereferencing inconsistent devmap entries can crash or oops the kernel in the packet redirect path. The race is repeatable by the local attacker, so availability impact is high.