SB2026062571 - Improper access control in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-53081)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass BPF verifier state pruning checks.

The vulnerability exists due to improper access control in the BPF verifier when comparing scalar registers carrying BPF_ADD_CONST state. A local user can load a specially crafted BPF program to bypass BPF verifier state pruning checks.

The issue occurs because compound scalar IDs are checked without ensuring consistent mapping of their underlying base IDs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/13c02881e49aac4c82b261faa26db9edf2567231
• https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0
• https://git.kernel.org/stable/c/691adf738817275368ed56311b7d798d617823a3
• https://git.kernel.org/stable/c/7d73c72cccac651acc891377a5e623e4021c6380