SB2026062567 - Improper access control in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-53095)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to modify kernel function arguments.

The vulnerability exists due to improper access control in the BPF kprobe and freplace program attachment logic when attaching a freplace program to a kprobe program with mismatched kprobe_write_ctx values. A local user can attach a crafted freplace program to a kprobe program to modify struct pt_regs and modify kernel function arguments.

This issue arises because uprobe programs use the KPROBE program type, enabling abuse of kprobe_write_ctx through the kprobe+freplace combination.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/611fe4b79af72d00d80f2223354284447daafae9
• https://git.kernel.org/stable/c/9836cadbd96c7e0dbb0018fa60e7872dd31ac4f8
• https://git.kernel.org/stable/c/b312cf41b9e43f442613053f6cad39898e1baf96