CVE-2026-53076: bpf: Fix OOB in pcpu_init_value

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-30
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix OOB in pcpu_init_value An out-of-bounds read occurs when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes. The issue happens when: 1. A CGROUP_STORAGE map is created with value_size not aligned to 8 bytes (e.g., 4 bytes) 2. A pcpu map is created with the same value_size (e.g., 4 bytes) 3. Update element in 2 with data in 1 pcpu_init_value assumes that all sources are rounded up to 8 bytes, and invokes copy_map_value_long to make a data copy, However, the assumption doesn't stand since there are some cases where the source may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data. the verifier verifies exactly the size that the source claims, not the size rounded up to 8 bytes by kernel, an OOB happens when the source has only 4 bytes while the copy size(4) is rounded up to 8.

Affected products

Linux kernel: from 5.4.78 before 5.5; from 5.9.9 before 5.10; from 5.10.1 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10 — fixed in 5.5, 5.10, 6.6.141, 6.12.91, 6.18.33, 7.0.10
Linux: from 5.4.78 before 5.5; from 5.9.9 before 5.10 — fixed in 5.5, 5.10

How to fix

Upgrade to a fixed version: Linux kernel 5.5, 5.10, 6.6.141, 6.12.91; Linux 5.5, 5.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53076 or the next vulnerability affects your stack