Incorrect Conversion between Numeric Types in Linux kernel - CVE-2026-53110
Published: June 25, 2026
Vulnerability identifier: #VU135190
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53110
CWE-ID: CWE-681
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause incorrect behavior in kernel BPF processing.
The vulnerability exists due to improper handling of integer extension in the s390 BPF JIT compiler when processing BPF program return values and kfunc arguments. A local user can trigger the JIT compilation of crafted BPF code to cause incorrect behavior in kernel BPF processing.
The issue affects s390 systems because the ABI requires zero extension for unsigned arguments and return values, but only sign extension was implemented.
How to mitigate CVE-2026-53110
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59
- https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797
- https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8
- https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34
- https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99