bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp.
CVE-2026-53078
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53078
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "db1200ec2c3ddf119d4d9ba67982063df06bbacb",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "4c1c5efd9d1d74743d41ce4e1600501b4feb6827",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "0e6b30657bbc771f38025c828d722b6162428508",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "64eaf4ecda007140ddcdb28e00c48c9c69aaba39",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "2a2c98141e0a75f2d4a7d78b0316c88b3da784ac",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "22400725de070b787cd6d806c5795370ab46d269",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "18e3ffde1822f0b48b1753bf34aa97ce839df1d8",
"versionType": "git"
},
{
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"lessThan": "10f86a2a5c91fc4c4d001960f1c21abe52545ef6",
"versionType": "git"
},
{
"status": "affected",
"version": "48be3df15aa19c04eadf156c9129293c9a10389f",
"versionType": "git"
},
{
"status": "affected",
"version": "cd4644d904e1d153d516e73e2e127e7a2fe687e1",
"versionType": "git"
},
{
"status": "affected",
"version": "6e0bc946cbeec538322820786b5fb5200a2216ab",
"versionType": "git"
},
{
"status": "affected",
"version": "a7e52f7f675046d9ffc5692d815fa67c82fcdbf5",
"versionType": "git"
},
{
"status": "affected",
"version": "db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef",
"versionType": "git"
},
{
"status": "affected",
"version": "5.7.18",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.8.4",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.61",
"lessThan": "5.5",
"versionType": "semver"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53078
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40745 · Revision 1
- Added to Heist Feed
- Publisher date