« Volver al listado

CVE-2026-53076

Estado: AnalizadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix OOB in pcpu_init_value

An out-of-bounds read occurs when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes.

The issue happens when: 1. A CGROUP_STORAGE map is created with value_size not aligned to 8 bytes (e.g., 4 bytes) 2. A pcpu map is created with the same value_size (e.g., 4 bytes) 3. Update element in 2 with data in 1

pcpu_init_value assumes that all sources are rounded up to 8 bytes, and invokes copy_map_value_long to make a data copy, However, the assumption doesn't stand since there are some cases where the source may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data. the verifier verifies exactly the size that the source claims, not the size rounded up to 8 bytes by kernel, an OOB happens when the source has only 4 bytes while the copy size(4) is rounded up to 8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

OOB en kernel de Linux (CWE-125) por falta de validación de alineación de bytes; acceso local con privilegios (PR:L) permite lectura de memoria kernel y potencial escalada de privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareData Loss Prevention

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-53076",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
              "lessThan": "e19c5ed9f1922a6854073f8651a63fa7be26e9e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
              "lessThan": "e0378419b0e20178b5d100b27c9cc7e51064202e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
              "lessThan": "6086079e6d1c32ba4c4b422612b8aebb1129a96c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
              "lessThan": "634a793d0e1c822412095d25a1338f8831ad894c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
              "lessThan": "576afddfee8d1108ee299bf10f581593540d1a36",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c602ad2b52dcbca5af08e5137bd5575c039b52e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab68b940dd6f7b5f8e2557937162dcb8a0583a05",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.78",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.9.9",
              "lessThan": "5.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-24T17:17:21.623",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/576afddfee8d1108ee299bf10f581593540d1a36",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6086079e6d1c32ba4c4b422612b8aebb1129a96c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/634a793d0e1c822412095d25a1338f8831ad894c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e0378419b0e20178b5d100b27c9cc7e51064202e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e19c5ed9f1922a6854073f8651a63fa7be26e9e9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix OOB in pcpu_init_value\n\nAn out-of-bounds read occurs when copying element from a\nBPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the\nsame value_size that is not rounded up to 8 bytes.\n\nThe issue happens when:\n1. A CGROUP_STORAGE map is created with value_size not aligned to\n   8 bytes (e.g., 4 bytes)\n2. A pcpu map is created with the same value_size (e.g., 4 bytes)\n3. Update element in 2 with data in 1\n\npcpu_init_value assumes that all sources are rounded up to 8 bytes,\nand invokes copy_map_value_long to make a data copy, However, the\nassumption doesn't stand since there are some cases where the source\nmay not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data.\nthe verifier verifies exactly the size that the source claims, not\nthe size rounded up to 8 bytes by kernel, an OOB happens when the\nsource has only 4 bytes while the copy size(4) is rounded up to 8."
    }
  ],
  "lastModified": "2026-07-21T18:14:03.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97B82710-BEDD-4221-B849-682CCB5CDFD9",
              "versionEndExcluding": "5.5",
              "versionStartIncluding": "5.4.78"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9598C575-CE16-4F2B-A517-667AA54B4B86",
              "versionEndExcluding": "5.10",
              "versionStartIncluding": "5.9.9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "281D841A-B4F4-48FC-8C9B-632707D1423A",
              "versionEndExcluding": "6.6.141",
              "versionStartIncluding": "5.10.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D",
              "versionEndExcluding": "6.12.91",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C",
              "versionEndExcluding": "6.18.33",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4",
              "versionEndExcluding": "7.0.10",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B29EBB93-107F-4ED6-8DE3-C2732BC659C3"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CD159FA-170F-4389-9085-CACCF97ABB1E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0390D83-6C17-4557-BE8D-B659E04F565A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4120E4B3-B66D-4ACE-8570-1DD4DF20A324"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73D60343-647D-4B5D-AA6D-CE87C462E368"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}