Skip to content
Heist/ feed
Back to feed
HighFix available

s390/bpf: Zero-extend bpf prog return values and kfunc arguments

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.

Products
Kernel
Affected versions
Not specified
Fixed versions
6.12.91, 6.18.33, 6.6.141, 7.0.10
CVEs
CVE-2026-53110
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 15:26 UTC · Revision 1

Source evidence

s390/bpf: Zero-extend bpf prog return values and kfunc arguments

core-osv · Original source

Published 24 Jun 2026, 16:30 UTC

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.

osv:CVE-2026-53110

Kernel

Fixed versions: 6.6.141, 6.12.91, 6.18.33, 7.0.10

Complete source record
{
  "id": "274dda283085399e3a2dce5a6fa8b0c753f43fb1397380cb91f6f56067e2ee24",
  "url": "https://osv.dev/vulnerability/CVE-2026-53110",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.",
    "evidence": "osv:CVE-2026-53110",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.141",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.91",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.33",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.10",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-53110",
      "aliases": [
        "CVE-2026-53110"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "528eb2cb87bc1353235a6384696b4849bde8b0ba"
                },
                {
                  "fixed": "edc90a12073b9a530064a99945c183dde120cb99"
                },
                {
                  "fixed": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
                },
                {
                  "fixed": "366b0e05ee24f5ba62bdc7ec1346038258b9a797"
                },
                {
                  "fixed": "834918a77be51419383bf1dda9f02b81ecf26b34"
                },
                {
                  "fixed": "202e42e4aa890172366354b233c42c73107a3f59"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53110.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.3.0"
                },
                {
                  "fixed": "6.6.141"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.91"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.33"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.10"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53110.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.794125094Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59",
        "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797",
        "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
        "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34",
        "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53110.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53110",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53110.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53110",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 496805,
  "published_at": "2026-06-24T16:30:44.036+00:00"
}