CVE-2026-53110 (GCVE-0-2026-53110)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
Title
s390/bpf: Zero-extend bpf prog return values and kfunc arguments
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < edc90a12073b9a530064a99945c183dde120cb99 (git)
Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 44c4f999b03f55debb1a0c5ab5c1796895a1adf8 (git)
Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 366b0e05ee24f5ba62bdc7ec1346038258b9a797 (git)
Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 834918a77be51419383bf1dda9f02b81ecf26b34 (git)
Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 202e42e4aa890172366354b233c42c73107a3f59 (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "edc90a12073b9a530064a99945c183dde120cb99",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "366b0e05ee24f5ba62bdc7ec1346038258b9a797",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "834918a77be51419383bf1dda9f02b81ecf26b34",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            },
            {
              "lessThan": "202e42e4aa890172366354b233c42c73107a3f59",
              "status": "affected",
              "version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\n\ns390x ABI requires callers to zero-extend unsigned arguments and\nsign-extend signed arguments, and callees to zero-extend unsigned\nreturn values and sign-extend signed return values.\n\ns390 BPF JIT currently implements only sign extension. Fix this\nomission and implement zero extension too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:23.053Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99"
        },
        {
          "url": "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797"
        },
        {
          "url": "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34"
        },
        {
          "url": "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59"
        }
      ],
      "title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53110",
    "datePublished": "2026-06-24T16:30:44.036Z",
    "dateReserved": "2026-06-09T07:44:35.385Z",
    "dateUpdated": "2026-08-05T12:33:23.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53110",
      "date": "2026-08-05",
      "epss": "0.0012",
      "percentile": "0.02133"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:42:15.000Z",
      "cve": "CVE-2026-53110",
      "id": "msrc_CVE-2026-53110",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53110.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53110\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:25.357\",\"lastModified\":\"2026-07-23T21:30:15.087\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\\n\\ns390x ABI requires callers to zero-extend unsigned arguments and\\nsign-extend signed arguments, and callees to zero-extend unsigned\\nreturn values and sign-extend signed return values.\\n\\ns390 BPF JIT currently implements only sign extension. Fix this\\nomission and implement zero extension too.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/s390/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"528eb2cb87bc1353235a6384696b4849bde8b0ba\",\"lessThan\":\"edc90a12073b9a530064a99945c183dde120cb99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"528eb2cb87bc1353235a6384696b4849bde8b0ba\",\"lessThan\":\"44c4f999b03f55debb1a0c5ab5c1796895a1adf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"528eb2cb87bc1353235a6384696b4849bde8b0ba\",\"lessThan\":\"366b0e05ee24f5ba62bdc7ec1346038258b9a797\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"528eb2cb87bc1353235a6384696b4849bde8b0ba\",\"lessThan\":\"834918a77be51419383bf1dda9f02b81ecf26b34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"528eb2cb87bc1353235a6384696b4849bde8b0ba\",\"lessThan\":\"202e42e4aa890172366354b233c42c73107a3f59\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/s390/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"681DADD7-FC7E-47E6-AC5C-0E445F6F3E42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:58+00:00",
      "cve": "CVE-2026-53110",
      "id": "CVE-2026-53110",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53110.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-03T03:05:08Z",
      "cve": "CVE-2026-53110",
      "id": "CVE-2026-53110",
      "initial_release_date": "2026-07-03T03:05:08Z",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "179",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53110",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53110.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.