CVE-2026-53096

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

The DEVMAP_HASH branch in dev_map_redirect_multi() uses

hlist_for_each_entry_safe() to iterate hash buckets, but this function

runs under RCU protection (called from xdp_do_generic_redirect_map()

in softirq context). Concurrent writers (__dev_map_hash_update_elem,

dev_map_hash_delete_elem) modify the list using RCU primitives

(hlist_add_head_rcu, hlist_del_rcu).

hlist_for_each_entry_safe() performs plain pointer dereferences without

rcu_dereference(), missing the acquire barrier needed to pair with

writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64,

POWER), a reader can observe a partially-constructed node. It also

defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race

detection.

Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()

as the lockdep condition, consistent with the rcu_dereference_check()

used i

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References