CVE-2026-53036

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fix off-by-one in check_imm signed range check

check_imm(bits, imm) is used in the arm64 BPF JIT to verify that

a branch displacement (in arm64 instruction units) fits into the

signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding

before it is handed to the encoder. The macro currently tests for

(imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits

values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A

signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check

admits one extra bit of range on each side.

In particular, for check_imm19(), values in [2^18, 2^19) slip past

the check but do not fit into the 19-bit signed imm19 field of

B.cond. aarch64_insn_encode_immediate() then masks the raw value

into the 19-bit field, setting bit 18 (the sign bit) and flipping

a forward branch into a backward one. Same class of issue exists

for check_imm26() and the B/BL encoding. Shi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References