CVE-2026-53076

A flaw was found in the Linux kernel. This vulnerability, located in the BPF (Berkeley Packet Filter) subsystem, involves an out-of-bounds read when data is copied between specific types of BPF maps. The system incorrectly handles data sizes that are not aligned to a specific memory boundary, causing it to read beyond the intended memory area. A local attacker could potentially exploit this issue to cause a system crash (denial of service) or gain access to sensitive information.

An out-of-bounds read can occur in BPF pcpu_init_value because copy_map_value_long copies a value rounded up to an 8 byte boundary even when the source object is only value_size bytes long. A local process can trigger this by using a BPF_MAP_TYPE_CGROUP_STORAGE value whose size is not aligned to 8 bytes, for example 4 bytes, and then copying it into a per CPU map with the same value_size. For the CVSS the PR:L is used because triggering requires local BPF map creation and update capability, which may be available to a local user or delegated service but is not a purely remote action. The issue is not network reachable and does not require user interaction. Impact is primarily a limited confidentiality risk from reading bytes past the source value, with possible low availability impact in hardened or sanitizer builds. No direct arbitrary write or UAF primitive is indicated, so privilege escalation is not assumed from the patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.