CVE-2026-53110 (GCVE-0-2026-53110)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.
References
Impacted products
Vendor Product Version
Linux Linux Version: 528eb2cb87bc1353235a6384696b4849bde8b0ba
Version: 528eb2cb87bc1353235a6384696b4849bde8b0ba
Version: 528eb2cb87bc1353235a6384696b4849bde8b0ba
Version: 528eb2cb87bc1353235a6384696b4849bde8b0ba
Version: 528eb2cb87bc1353235a6384696b4849bde8b0ba
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "edc90a12073b9a530064a99945c183dde120cb99",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "366b0e05ee24f5ba62bdc7ec1346038258b9a797",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "834918a77be51419383bf1dda9f02b81ecf26b34",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "202e42e4aa890172366354b233c42c73107a3f59",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\n\ns390x ABI requires callers to zero-extend unsigned arguments and\nsign-extend signed arguments, and callees to zero-extend unsigned\nreturn values and sign-extend signed return values.\n\ns390 BPF JIT currently implements only sign extension. Fix this\nomission and implement zero extension too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:23.053Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99"
        },
        {
          "url": "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797"
        },
        {
          "url": "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34"
        },
        {
          "url": "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59"
        }
      ],
      "title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53110",
    "datePublished": "2026-06-24T16:30:44.036Z",
    "dateReserved": "2026-06-09T07:44:35.385Z",
    "dateUpdated": "2026-08-05T12:33:23.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.