CVE-2026-53110

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) JIT (Just-In-Time) compiler for the s390x architecture. The system's Application Binary Interface (ABI) requires that unsigned arguments and return values be zero-extended. However, the BPF JIT compiler incorrectly performed only sign extension. This could lead to unexpected behavior or data integrity issues when BPF programs interact with kernel functions on s390x systems.

A s390 BPF JIT ABI mismatch can occur because unsigned BPF trampoline return values and kfunc arguments were sign extended instead of zero extended. Values of 1, 2, or 4 byte unsigned types with the top bit set may therefore reach kernel kfuncs or trampoline return handling with incorrect upper register bits. This is not directly network reachable and requires local ability to load or attach a relevant BPF program on s390. For the CVSS the PR:L is used because the practical trigger requires a local user or service account with BPF related permissions rather than remote packet reachability. Impact is primarily incorrect kernel side semantics with possible integrity impact or denial of service if the wrong value is used as a size, index, flag, or return code. For the paranoid score, the highest still defensible interpretation is C:L/I:L/A:H because the bug affects BPF JIT and kfunc call semantics, but the patch does not show a direct UAF, OOB write, or arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.