CVE-2026-53092 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been addressed. The issue arose in the register delta tracking mechanism when the source and destination registers pointed to the same state. This scenario, particularly in operations like addition or subtraction, led to an incorrect delta being calculated and propagated to linked registers. Such a mismatch created discrepancies between the BPF verifier and the runtime environment, potentially causing verification errors.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-53092 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492362 | redhat-SADP | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53092.json | redhat-SADP | Third Party Advisory |
| https://git.kernel.org/stable/c/1509c1ae9185ec7103899967ed788b6eebab3fcc | kernel.org | |
| https://git.kernel.org/stable/c/cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de | kernel.org | Patch |
| https://git.kernel.org/stable/c/d7f14173c0d5866c3cae759dee560ad1bed10d2e | kernel.org | Patch |
| https://git.kernel.org/stable/c/d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-393 | Return of Wrong Status Code | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.11, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 23, 2026 | CVE Modified | kernel.org |
| Jul 23, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | New CVE Received | kernel.org |