CVE-2026-53036

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An off-by-one error exists in the arm64 BPF JIT (Just-In-Time compiler) within the check imm(bits, imm) macro. This macro is used to verify that a branch displacement fits into the signed N-bit immediate field of B, B.cond, or CBZ/CBNZ encodings. The current implementation incorrectly allows values in a signed (N+1)-bit range instead of the required N-bit range. Specifically, for check imm19(), values in the [2^18, 2^19) range bypass the check, causing aarch64 insn encode immediate() to mask the value and flip a forward branch into a backward one. A similar issue affects check imm26() and the B/BL encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.