PT-2026-51972 · Linux+2 · Linux Kernel+2
CVE-2026-53078
·
Published
2026-04-12
·
Updated
2026-09-07
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An issue exists in the BPF sock ops program when accessing
ctx fields where the destination register dst reg is the same as the source register src reg. In the !fullsock or !locked tcp sock paths, the SOCK OPS GET SK() and SOCK OPS GET FIELD() macros fail to zero the destination register, leaving a stale ctx pointer. This leads to two primary risks:- In
SOCK OPS GET SK(), thedst regretains thectxpointer and may bypass NULL checks asPTR TO SOCKET OR NULL, potentially resulting in stack-out-of-bounds access when used in helpers such asbpf skc to tcp6 sock(). - In
SOCK OPS GET FIELD(), thedst regretains thectxpointer, which the verifier incorrectly treats as aSCALAR VALUE, leading to a kernel pointer leak.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Out of bounds Read
Buffer Over-read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu