CVE-2026-53078 - Vulnerability Details

- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,
the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the
destination register in the !fullsock / !locked_tcp_sock path.

Both macros borrow a temporary register to check is_fullsock /
is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the
ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with
a request_sock), dst_reg should be zeroed but is not, leaving the stale
ctx pointer:

- SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks
as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,
leading to stack-out-of-bounds access in helpers like
bpf_skc_to_tcp6_sock().

- SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the
verifier believes is a SCALAR_VALUE, leaking a kernel pointer.

Fix both macros by:
- Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
added instruction.
- Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
restore in the !fullsock path, placed after the restore because
dst_reg == src_reg means we need src_reg intact to read ctx->temp.

Published: 2026-06-24

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In Linux kernel BPF sock_ops programs, when the destination and source registers are the same, the macros SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() incorrectly leave the destination register unchanged after a failed full socket check. This stale ctx pointer can be treated as a socket pointer, potentially leading to a stack-out-of-bounds access, or it can be exposed to the verifier as a scalar value, leaking a kernel address. The vulnerability allows old or malicious BPF programs to expose kernel memory pointers.

Affected Systems

All Linux kernel versions before the patch commit 10f86a2a5c91fc4c4d001960f1c21abe52545ef6 and 18e3ffde1822f0b48b1753bf34aa97ce839df1d8 are impacted; users should apply any kernel updates that incorporate these patches.

Risk and Exploitability

The CVSS score of 7.8 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The flaw permits a BPF sock_ops program that incorrectly accesses registers to leak kernel pointers or trigger out-of-bounds reads. Exploitation would require loading a malicious BPF sock_ops program, for which the CVE description does not specify the privilege level or exact conditions. The vulnerability is not listed in CISA KEV.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fd09af010788a884de1c39537c288830c3d305db`	affected	< 18e3ffde1822f0b48b1753bf34aa97ce839df1d8
`fd09af010788a884de1c39537c288830c3d305db`	affected	< 10f86a2a5c91fc4c4d001960f1c21abe52545ef6
`48be3df15aa19c04eadf156c9129293c9a10389f`	affected	—
`cd4644d904e1d153d516e73e2e127e7a2fe687e1`	affected	—
`6e0bc946cbeec538322820786b5fb5200a2216ab`	affected	—
`a7e52f7f675046d9ffc5692d815fa67c82fcdbf5`	affected	—
`db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef`	affected	—
`5.7.18`	affected	< 5.8
`5.8.4`	affected	< 5.9
`5.4.61`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fd09af010788a884de1c39537c288830c3d305db,18e3ffde1822f0b48b1753bf34aa97ce839df1d8)`	affected	generic	—
`[fd09af010788a884de1c39537c288830c3d305db,10f86a2a5c91fc4c4d001960f1c21abe52545ef6)`	affected	generic	—
`48be3df15aa19c04eadf156c9129293c9a10389f`	affected	code_commit	—
`cd4644d904e1d153d516e73e2e127e7a2fe687e1`	affected	code_commit	—
`6e0bc946cbeec538322820786b5fb5200a2216ab`	affected	code_commit	—
`a7e52f7f675046d9ffc5692d815fa67c82fcdbf5`	affected	code_commit	—
`db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef`	affected	code_commit	—
`[5.7.18,5.8)`	affected	semver	—
`[5.8.4,5.9)`	affected	semver	—
`[5.4.61,5.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.9`	affected	semver	—
`[0,5.9)`	unaffected	semver	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the fix committed in https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6 and https://git.kernel.org/stable/c/18e3ffde1822f0b48b1753bf34aa97ce839df1d8
If a kernel upgrade cannot be applied immediately, restrict the ability to load BPF sock_ops programs to trusted system components by limiting privileges or using role-based access control
After applying the update or restriction, reboot the system to ensure the fixed kernel code is active

Generated by OpenCVE AI on June 28, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00112.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6
https://git.kernel.org/stable/c/18e3ffde1822f0b48b1753bf34aa97ce839df1d8
https://lore.kernel.org/linux-cve-announce/2026062406-CVE-2026-53078-bc4a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53078
https://www.cve.org/CVERecord?id=CVE-2026-53078

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-126 CWE-200

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026062406-CVE-2026-53078-bc4a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53078 https://www.cve.org/CVERecord?id=CVE-2026-53078
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-126 CWE-200

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp.
Title		bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6 https://git.kernel.org/stable/c/18e3ffde1822f0b48b1753bf34aa97ce839df1d8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:30:18.858Z

Updated: 2026-06-28T06:39:04.474Z

Reserved: 2026-06-09T07:44:35.383Z

Link: CVE-2026-53078

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53078 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:30:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object