Zero-Extension Flaw in Linux Kernel BPF JIT

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53110

EUVD

EUVD-2026-38978

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability relates to the Linux kernel's handling of BPF (Berkeley Packet Filter) programs on the s390 architecture. Specifically, the s390x ABI requires that unsigned arguments and return values be zero-extended, while signed arguments and return values be sign-extended. However, the s390 BPF JIT (Just-In-Time compiler) only implemented sign extension and omitted zero extension. This omission could lead to incorrect handling of unsigned values in BPF programs.

Impact Analysis

The impact of this vulnerability is related to the incorrect processing of unsigned arguments and return values in BPF programs on s390 systems. This could potentially cause unexpected behavior or errors in programs relying on BPF JIT compilation, possibly leading to system instability or incorrect program execution.

Hi! I’m here to help you understand CVE-2026-53110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70