CVE-2026-53081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53081", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.383Z", "datePublished": "2026-06-24T16:30:21.959Z", "dateUpdated": "2026-10-19T19:47:15.896Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:12.279Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars\n\nWhen regsafe() compares two scalar registers that both carry\nBPF_ADD_CONST, check_scalar_ids() maps their full compound id\n(aka base | BPF_ADD_CONST flag) as one idmap entry. However,\nit never verifies that the underlying base ids, that is, with\nthe flag stripped are consistent with existing idmap mappings.\n\nThis allows construction of two verifier states where the old\nstate has R3 = R2 + 10 (both sharing base id A) while the current\nstate has R3 = R4 + 10 (base id C, unrelated to R2). The idmap\ncreates two independent entries: A->B (for R2) and A|flag->C|flag\n(for R3), without catching that A->C conflicts with A->B. State\npruning then incorrectly succeeds.\n\nFix this by additionally verifying base ID mapping consistency\nwhenever BPF_ADD_CONST is set: after mapping the compound ids,\nalso invoke check_ids() on the base IDs (flag bits stripped).\nThis ensures that if A was already mapped to B from comparing\nthe source register, any ADD_CONST derivative must also derive\nfrom B, not an unrelated C."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable verifier path is reached by a local attacker through the bpf() syscall with BPF_PROG_LOAD, not by remote packets or adjacent/physical input. The crafted program then drives verifier state pruning into regsafe()/check_scalar_ids().\nAC:L - Exploitation depends on constructing specific BPF instructions and verifier states, but there is no race or external condition outside the attacker's control. The verifier behavior is deterministic once the crafted program is submitted.\nPR:L - The affected BPF_ADD_CONST tracking is gated on privileged BPF loading through CAP_BPF or an equivalent BPF token, but BPF tokens can delegate this capability into user namespaces in realistic containerized deployments. Under the required highest-severity reasonable scenario, this is low privilege rather than init-namespace root only.\nUI:N - No victim action is required; the attacker submits and executes the crafted BPF program directly through local kernel interfaces. Loading and triggering the program are attacker-controlled.\nS:U - The vulnerability is a kernel BPF verifier flaw that affects the same kernel security authority. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - An unsound verifier state-pruning decision can allow an unsafe BPF program to pass validation, enabling kernel memory reads through invalid bounds or scalar relationship assumptions. BPF verifier bypasses are generally exploitable for high-impact information disclosure.\nI:H - By accepting an unsafe BPF program, the verifier can permit memory accesses or control effects that should have been rejected, supporting arbitrary kernel memory modification or code execution. This is a high-integrity kernel compromise scenario.\nA:H - Even if not fully weaponized for read/write primitives, an unsafe accepted BPF program can crash or panic the kernel through invalid memory access. Kernel crash availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "13c02881e49aac4c82b261faa26db9edf2567231", "status": "affected", "versionType": "git"}, {"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "691adf738817275368ed56311b7d798d617823a3", "status": "affected", "versionType": "git"}, {"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "7d73c72cccac651acc891377a5e623e4021c6380", "status": "affected", "versionType": "git"}, {"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/13c02881e49aac4c82b261faa26db9edf2567231"}, {"url": "https://git.kernel.org/stable/c/691adf738817275368ed56311b7d798d617823a3"}, {"url": "https://git.kernel.org/stable/c/7d73c72cccac651acc891377a5e623e4021c6380"}, {"url": "https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0"}], "title": "bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-06-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. This vulnerability occurs due to inconsistent base ID mapping when the `regsafe()` function compares scalar registers with `BPF_ADD_CONST` values. This inconsistency allows the BPF verifier to incorrectly succeed in state pruning, which could enable a bypass of its security mechanisms. Such a bypass may lead to unexpected system behavior or potentially allow an attacker to execute unauthorized operations."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-386", "description": "Symbolic Name not Mapping to Correct Object", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-53081"}, {"name": "RHBZ#2492322", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492322"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53081.json"}], "timeline": [{"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Made public."}], "title": "kernel: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T00:45:06.204Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:25:22.428646Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-386", "description": "CWE-386 Symbolic Name not Mapping to Correct Object"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:15.896Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "kernel: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-06-24T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-53081", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492322", "name": "RHBZ#2492322", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53081.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. This vulnerability occurs due to inconsistent base ID mapping when the `regsafe()` function compares scalar registers with `BPF_ADD_CONST` values. This inconsistency allows the BPF verifier to incorrectly succeed in state pruning, which could enable a bypass of its security mechanisms. Such a bypass may lead to unexpected system behavior or potentially allow an attacker to execute unauthorized operations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-386", "description": "Symbolic Name not Mapping to Correct Object"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T00:45:06.204Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:25:22.428646Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-386", "description": "CWE-386 Symbolic Name not Mapping to Correct Object"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:25:23.033Z"}}], "cna": {"title": "bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable verifier path is reached by a local attacker through the bpf() syscall with BPF_PROG_LOAD, not by remote packets or adjacent/physical input. The crafted program then drives verifier state pruning into regsafe()/check_scalar_ids().\nAC:L - Exploitation depends on constructing specific BPF instructions and verifier states, but there is no race or external condition outside the attacker's control. The verifier behavior is deterministic once the crafted program is submitted.\nPR:L - The affected BPF_ADD_CONST tracking is gated on privileged BPF loading through CAP_BPF or an equivalent BPF token, but BPF tokens can delegate this capability into user namespaces in realistic containerized deployments. Under the required highest-severity reasonable scenario, this is low privilege rather than init-namespace root only.\nUI:N - No victim action is required; the attacker submits and executes the crafted BPF program directly through local kernel interfaces. Loading and triggering the program are attacker-controlled.\nS:U - The vulnerability is a kernel BPF verifier flaw that affects the same kernel security authority. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - An unsound verifier state-pruning decision can allow an unsafe BPF program to pass validation, enabling kernel memory reads through invalid bounds or scalar relationship assumptions. BPF verifier bypasses are generally exploitable for high-impact information disclosure.\nI:H - By accepting an unsafe BPF program, the verifier can permit memory accesses or control effects that should have been rejected, supporting arbitrary kernel memory modification or code execution. This is a high-integrity kernel compromise scenario.\nA:H - Even if not fully weaponized for read/write primitives, an unsafe accepted BPF program can crash or panic the kernel through invalid memory access. Kernel crash availability impact is high."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "13c02881e49aac4c82b261faa26db9edf2567231", "versionType": "git"}, {"status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "691adf738817275368ed56311b7d798d617823a3", "versionType": "git"}, {"status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "7d73c72cccac651acc891377a5e623e4021c6380", "versionType": "git"}, {"status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0", "versionType": "git"}], "programFiles": ["kernel/bpf/verifier.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/verifier.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/13c02881e49aac4c82b261faa26db9edf2567231"}, {"url": "https://git.kernel.org/stable/c/691adf738817275368ed56311b7d798d617823a3"}, {"url": "https://git.kernel.org/stable/c/7d73c72cccac651acc891377a5e623e4021c6380"}, {"url": "https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars\n\nWhen regsafe() compares two scalar registers that both carry\nBPF_ADD_CONST, check_scalar_ids() maps their full compound id\n(aka base | BPF_ADD_CONST flag) as one idmap entry. However,\nit never verifies that the underlying base ids, that is, with\nthe flag stripped are consistent with existing idmap mappings.\n\nThis allows construction of two verifier states where the old\nstate has R3 = R2 + 10 (both sharing base id A) while the current\nstate has R3 = R4 + 10 (base id C, unrelated to R2). The idmap\ncreates two independent entries: A->B (for R2) and A|flag->C|flag\n(for R3), without catching that A->C conflicts with A->B. State\npruning then incorrectly succeeds.\n\nFix this by additionally verifying base ID mapping consistency\nwhenever BPF_ADD_CONST is set: after mapping the compound ids,\nalso invoke check_ids() on the base IDs (flag bits stripped).\nThis ensures that if A was already mapped to B from comparing\nthe source register, any ADD_CONST derivative must also derive\nfrom B, not an unrelated C."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:12.279Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53081", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:47:15.896Z", "dateReserved": "2026-06-09T07:44:35.383Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T16:30:21.959Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "13c02881e49aac4c82b261faa26db9edf2567231", "status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "versionType": "git"}, {"lessThan": "691adf738817275368ed56311b7d798d617823a3", "status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "versionType": "git"}, {"lessThan": "7d73c72cccac651acc891377a5e623e4021c6380", "status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "versionType": "git"}, {"lessThan": "2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0", "status": "affected", "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "88847604-FD87-4DC8-8370-F07E77FD74A2", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars\n\nWhen regsafe() compares two scalar registers that both carry\nBPF_ADD_CONST, check_scalar_ids() maps their full compound id\n(aka base | BPF_ADD_CONST flag) as one idmap entry. However,\nit never verifies that the underlying base ids, that is, with\nthe flag stripped are consistent with existing idmap mappings.\n\nThis allows construction of two verifier states where the old\nstate has R3 = R2 + 10 (both sharing base id A) while the current\nstate has R3 = R4 + 10 (base id C, unrelated to R2). The idmap\ncreates two independent entries: A->B (for R2) and A|flag->C|flag\n(for R3), without catching that A->C conflicts with A->B. State\npruning then incorrectly succeeds.\n\nFix this by additionally verifying base ID mapping consistency\nwhenever BPF_ADD_CONST is set: after mapping the compound ids,\nalso invoke check_ids() on the base IDs (flag bits stripped).\nThis ensures that if A was already mapped to B from comparing\nthe source register, any ADD_CONST derivative must also derive\nfrom B, not an unrelated C."}], "id": "CVE-2026-53081", "lastModified": "2026-10-19T20:19:01.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53081", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:25:22.428646Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:22.233", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/13c02881e49aac4c82b261faa26db9edf2567231"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/691adf738817275368ed56311b7d798d617823a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d73c72cccac651acc891377a5e623e4021c6380"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-53081"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492322"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Third Party Advisory"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53081.json"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-386"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-386"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars", "id": "2492322", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492322"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-386", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars\nWhen regsafe() compares two scalar registers that both carry\nBPF_ADD_CONST, check_scalar_ids() maps their full compound id\n(aka base | BPF_ADD_CONST flag) as one idmap entry. However,\nit never verifies that the underlying base ids, that is, with\nthe flag stripped are consistent with existing idmap mappings.\nThis allows construction of two verifier states where the old\nstate has R3 = R2 + 10 (both sharing base id A) while the current\nstate has R3 = R4 + 10 (base id C, unrelated to R2). The idmap\ncreates two independent entries: A->B (for R2) and A|flag->C|flag\n(for R3), without catching that A->C conflicts with A->B. State\npruning then incorrectly succeeds.\nFix this by additionally verifying base ID mapping consistency\nwhenever BPF_ADD_CONST is set: after mapping the compound ids,\nalso invoke check_ids() on the base IDs (flag bits stripped).\nThis ensures that if A was already mapped to B from comparing\nthe source register, any ADD_CONST derivative must also derive\nfrom B, not an unrelated C.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. This vulnerability occurs due to inconsistent base ID mapping when the `regsafe()` function compares scalar registers with `BPF_ADD_CONST` values. This inconsistency allows the BPF verifier to incorrectly succeed in state pruning, which could enable a bypass of its security mechanisms. Such a bypass may lead to unexpected system behavior or potentially allow an attacker to execute unauthorized operations."], "name": "CVE-2026-53081", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53081\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53081\nhttps://lore.kernel.org/linux-cve-announce/2026062407-CVE-2026-53081-4676@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d7ca374ba4b39e7535613d40e159f09ca14da2,13c02881e49aac4c82b261faa26db9edf2567231)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d7ca374ba4b39e7535613d40e159f09ca14da2,691adf738817275368ed56311b7d798d617823a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d7ca374ba4b39e7535613d40e159f09ca14da2,7d73c72cccac651acc891377a5e623e4021c6380)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d7ca374ba4b39e7535613d40e159f09ca14da2,2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T20:15:07.668939+00:00", "updated": "2026-08-12T07:00:12.551526+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}