CVE-2026-53090
kernel: bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 24, 2026
Updated · July 6, 2026
Description
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. When ld_{abs,ind} instructions are used in BPF subprograms, the verifier fails to correctly simulate the abnormal exit path if packet data loading fails. This oversight could lead to unexpected behavior or bypass of security checks within the BPF execution environment.
Statement
This CVE has been rated as Moderate because eBPF (and XDP) is restricted to root-only on Red Hat Enterprise Linux.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-253 · Incorrect Check of Function Return Value