CVE-2026-53094

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where a stale pointer is maintained after constant blinding. When a dev-bound-only BPF program (BPF F XDP DEV BOUND ONLY) undergoes JIT compilation with constant blinding enabled (where bpf jit harden is 2 or greater), the bpf jit blind constants() function clones the program. The original program is then freed in bpf jit prog release other(). While this function updates aux->prog to point to the surviving clone, it fails to update offload->prog.

This results in offload->prog pointing to freed memory. When the network namespace is destroyed, cleanup net() triggers bpf dev bound netdev unregister(), which calls bpf prog offload destroy(offload->prog). Accessing this freed pointer causes a page fault, leading to a system crash. Constant blinding is a security feature used to prevent JIT spraying attacks by masking immediate values in the compiled code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.