CVE-2026-53094High· 7.8▾ Twilight

bpf: Fix stale offload->prog pointer after constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stale offload->prog pointer after constant blinding When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blind…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 24, 2026

Updated

Oct 19, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.13% · p3

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 117 days

Jun 24, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.1%
Oct 19, 2026Record revised
Last analysed / modified upstream

Linux #cve.org

Affected

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a713b72ff88cdab4d5d692908ab1259ada511f4d
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 25484c39d1ec82a0368798d956da3de5039b3fe8
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 059525cf18e69a9313baf947d8898c6ee7ca6b65
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < c79f8503d83d4665be461fb9e45e215d0380c67b
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a1aa9ef47c299c5bbc30594d3c2f0589edf908e6
Linux 6.3

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stale offload->prog pointer after constant blinding

When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blinding enabled (bpf_jit_harden >= 2), bpf_jit_blind_constants() clones the program. The original prog is then freed in bpf_jit_prog_release_other(), which updates aux->prog to point to the surviving clone, but fails to update offload->prog.

This leaves offload->prog pointing to the freed original program. When the network namespace is subsequently destroyed, cleanup_net() triggers bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls __bpf_prog_offload_destroy(offload->prog). Accessing the freed prog causes a page fault:

BUG: unable to handle page fault for address: ffffc900085f1038 Workqueue: netns cleanup_net RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80 Call Trace: __bpf_offload_dev_netdev_unregister+0x257/0x350 bpf_dev_bound_netdev_unregister+0x4a/0x90 unregister_netdevice_many_notify+0x2a2/0x660 ... cleanup_net+0x21a/0x320

The test sequence that triggers this reliably is:

Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden)
Run xdp_metadata selftest, which creates a dev-bound-only XDP program on a veth inside a netns (./test_progs -t xdp_metadata)
cleanup_net -> page fault in __bpf_prog_offload_destroy

Dev-bound-only programs are unique in that they have an offload structure but go through the normal JIT path instead of bpf_prog_offload_compile(). This means they are subject to constant blinding's prog clone-and-replace, while also having offload->prog that must stay in sync.

Fix this by updating offload->prog in bpf_jit_prog_release_other(), alongside the existing aux->prog update. Both are back-pointers to the prog that must be kept in sync when the prog is replaced.

Affected

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a713b72ff88cdab4d5d692908ab1259ada511f4d
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 25484c39d1ec82a0368798d956da3de5039b3fe8
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 059525cf18e69a9313baf947d8898c6ee7ca6b65
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < c79f8503d83d4665be461fb9e45e215d0380c67b
Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a1aa9ef47c299c5bbc30594d3c2f0589edf908e6
Linux 6.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

bpf: Fix stale offload->prog pointer after constant blinding

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stale offload->prog pointer after constant blinding

The test sequence that triggers this reliably is:

Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden)

Run xdp_metadata selftest, which creates a dev-bound-only XDP program on a veth inside a netns (./test_progs -t xdp_metadata)

cleanup_net -> page fault in __bpf_prog_offload_destroy

Fix this by updating offload->prog in bpf_jit_prog_release_other(), alongside the existing aux->prog update. Both are back-pointers to the prog that must be kept in sync when the prog is replaced.

Affected

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a713b72ff88cdab4d5d692908ab1259ada511f4d

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 25484c39d1ec82a0368798d956da3de5039b3fe8

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < 059525cf18e69a9313baf947d8898c6ee7ca6b65

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < c79f8503d83d4665be461fb9e45e215d0380c67b

Linux >= 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 < a1aa9ef47c299c5bbc30594d3c2f0589edf908e6

Linux 6.3