CVE-2026-53096

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where the DEVMAP HASH branch in the dev map redirect multi() function uses hlist for each entry safe() to iterate through hash buckets. This function is executed under Read-Copy-Update (RCU) protection, but hlist for each entry safe() performs plain pointer dereferences without using rcu dereference(). This omission lacks the necessary acquire barrier to pair with the rcu assign pointer() used by concurrent writers in dev map hash update elem() and dev map hash delete elem(). On weakly-ordered architectures such as ARM64 and POWER, this can lead to a reader observing a partially-constructed node. Additionally, this behavior bypasses CONFIG PROVE RCU lockdep validation and KCSAN data-race detection. A similar incorrect lockdep is held(&dtab->index lock) condition was also identified in the dev map enqueue multi() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.