CVE-2026-53092

Awaiting Analysis Awaiting Analysis - Queue

BPF linked reg delta tracking fix for kernel

Publication date: 2026-06-24

Last updated on: 2026-07-15

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-15

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53092

EUVD

EUVD-2026-38960

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-393	A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It occurs when the source and destination registers are the same in an operation like rX += rX. The issue arises because the code modifies the destination register in-place and then incorrectly reads the updated value of the source register instead of its original value during delta tracking. This leads to an incorrect delta calculation, which is then propagated to linked registers, causing a mismatch between the verifier's expectations and the runtime behavior.

The fix involves skipping this specific corner case to prevent the incorrect delta tracking and ensure consistency between the verifier and runtime.

Impact Analysis

This vulnerability can cause a mismatch between the BPF verifier's analysis and the actual runtime behavior of BPF programs. Such a verifier-vs-runtime mismatch could potentially lead to incorrect program execution or security checks being bypassed, which might result in unexpected behavior or security risks within the Linux kernel environment.

Hi! I’m here to help you understand CVE-2026-53092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70