Race condition in Linux kernel - CVE-2026-53096
Published: June 25, 2026
Vulnerability identifier: #VU135219
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53096
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an improper use of RCU-safe iteration in dev_map_redirect_multi() and dev_map_enqueue_multi() when processing BPF devmap hash buckets under RCU protection. A local user can trigger concurrent updates and lookups to cause a denial of service.
On weakly ordered architectures, readers may observe a partially constructed node.
How to mitigate CVE-2026-53096
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/4a3d0fe30b907ff324b1b49756f7e713d67f3645
- https://git.kernel.org/stable/c/571a05ea1baaccc0dc1e0d227b2cbc978b96d392
- https://git.kernel.org/stable/c/7027e705062482a8cea43a1c13ede3c35653966f
- https://git.kernel.org/stable/c/8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19
- https://git.kernel.org/stable/c/b089aa6e94d7a08e74d076a0fe274842dc9feccc
- https://git.kernel.org/stable/c/cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a
- https://git.kernel.org/stable/c/d4c4bd231ebad70e6f30db429e9640bf378b2f52