CVE-2026-53094

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stale offload->prog pointer after constant blinding

When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes

JIT compilation with constant blinding enabled (bpf_jit_harden >= 2),

bpf_jit_blind_constants() clones the program. The original prog is then

freed in bpf_jit_prog_release_other(), which updates aux->prog to point

to the surviving clone, but fails to update offload->prog.

This leaves offload->prog pointing to the freed original program. When

the network namespace is subsequently destroyed, cleanup_net() triggers

bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls

__bpf_prog_offload_destroy(offload->prog). Accessing the freed prog

causes a page fault:

BUG: unable to handle page fault for address: ffffc900085f1038

Workqueue: netns cleanup_net

RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80

Call Trace:

__bpf_offload_dev_netdev_unregister+0x257/0x350

bpf_dev_bound_netdev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References