CVE-2026-53031

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in Linux Kernel BPF

Publication date: 2026-06-24

Last updated on: 2026-07-10

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate node_id in arena_alloc_pages() arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking. Validate node_id before passing it down the allocation chain in arena_alloc_pages().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-10

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53031

EUVD

EUVD-2026-38899

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's bpf subsystem, specifically in the function arena_alloc_pages(). The function accepts a node_id parameter as a plain integer but does not perform any bounds checking on it before forwarding it through the allocation chain.

The issue was that node_id could be invalid or out of expected range, potentially causing unexpected behavior or errors during memory allocation. The fix involved adding validation of node_id before it is passed down the allocation chain in arena_alloc_pages().

Impact Analysis

Improper validation of node_id in memory allocation could lead to memory corruption, crashes, or other unpredictable behavior in the Linux kernel. This could affect system stability and security, potentially allowing attackers to exploit the kernel for privilege escalation or denial of service.

Hi! I’m here to help you understand CVE-2026-53031. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70