Answer in brief
CVE-2026-53094 records a High severity (CVSS 7.8) vulnerability in bpf: Fix stale offload->prog pointer after constant blinding. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2b3486bc2d237ec345b3942b7be5deabf8c8fed1 <a713b72ff88cdab4d5d692908ab1259ada511f4d || >=2b3486bc2d237ec345b3942b7be5deabf8c8fed1 <25484c39d1ec82a0368798d956da3de5039b3fe8 || >=2b3486bc2d237ec345b3942b7be5deabf8c8fed1 <059525cf18e69a9313baf947d8898c6ee7ca6b65 || >=2b3486bc2d237ec345b3942b7be5deabf8c8fed1 <c79f8503d83d4665be461fb9e45e215d0380c67b || >=2b3486bc2d237ec345b3942b7be5deabf8c8fed1 <a1aa9ef47c299c5bbc30594d3c2f0589edf908e6 | a713b72ff88cdab4d5d692908ab1259ada511f4d, 25484c39d1ec82a0368798d956da3de5039b3fe8, 059525cf18e69a9313baf947d8898c6ee7ca6b65, c79f8503d83d4665be461fb9e45e215d0380c67b, a1aa9ef47c299c5bbc30594d3c2f0589edf908e6 |
| Linux/Linuxgeneric | 6.3 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stale offload->prog pointer after constant blinding When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blinding enabled (bpf_jit_harden >= 2), bpf_jit_blind_constants() clones the program. The original prog is then freed in bpf_jit_prog_release_other(), which updates aux->prog to point to the surviving clone, but fails to update offload->prog. This leaves offload->prog pointing to the freed original program. When the network namespace is subsequently destroyed, cleanup_net() triggers bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls __bpf_prog_offload_destroy(offload->prog). Accessing the freed prog causes a page fault: BUG: unable to handle page fault for address: ffffc900085f1038 Workqueue: netns cleanup_net RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80 Call Trace: __bpf_offload_dev_netdev_unregister+0x257/0x350 bpf_dev_bound_netdev_unregister+0x4a/0x90 unregister_netdevice_many_notify+0x2a2/0x660 ... cleanup_net+0x21a/0x320 The test sequence that triggers this reliably is: 1. Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden) 2. Run xdp_metadata selftest, which creates a dev-bound-only XDP program on a veth inside a netns (./test_progs -t xdp_metadata) 3. cleanup_net -> page fault in __bpf_prog_offload_destroy Dev-bound-only programs are unique in that they have an offload structure but go through the normal JIT path instead of bpf_prog_offload_compile(). This means they are subject to constant blinding's prog clone-and-replace, while also having offload->prog that must stay in sync. Fix this by updating offload->prog in bpf_jit_prog_release_other(), alongside the existing aux->prog update. Both are back-pointers to the prog that must be kept in sync when the prog is replaced.
Quoted source text, attributed separately from HOL analysis.