Linux kernel BPF arena: unvalidated NUMA node_id passed down the page allocation chain

Impact

arena_alloc_pages() took a plain int node_id from its caller and forwarded it through the whole allocation chain with no bounds check, so an out-of-range or negative node id reaches the page allocator and indexes node data structures that do not exist. On a multi-socket GPU node - which is every serious training host, and where NUMA node count is exactly what BPF arena users care about - that is an out-of-bounds read of kernel memory or a crash during allocation. The code path belongs to BPF arena, so the caller needs to be able to load BPF programs. The record gives the missing validation and nothing about a demonstrated exploit, so treat node crash as the established outcome.

Who can reach it

Local. A process able to load BPF programs that use arena maps, in practice CAP_BPF or CAP_SYS_ADMIN - so observability agents, eBPF-based CNIs and service meshes, and any tenant you have granted those capabilities to. Unprivileged users without BPF access cannot reach it.

What to do

Take the fixed stable kernel and reboot. Until then, the meaningful control is auditing which workloads hold CAP_BPF on your nodes - eBPF agents are usually the only legitimate holders, and tenants should not have it. No module-level fix.

References

Related entries

• Linux kernel BPF sockmap: use-after-free on the af_unix peer when a socket closes during iterationCVE-2026-53033 · Linux kernel BPF sockmap (unix_stream_bpf_update_proto, af_unix iterator)High
• Linux kernel BPF: sock_ops same-register context access leaks a kernel pointer and reads out of boundsCVE-2026-53078 · Linux kernel BPF sock_ops context access (SOCK_OPS_GET_SK / SOCK_OPS_GET_FIELD)High
• Linux kernel BPF verifier: inconsistent ADD_CONST base ids let unsafe state pruning succeedCVE-2026-53081 · Linux kernel BPF verifier (regsafe base-id consistency for BPF_ADD_CONST scalars)High
• Linux kernel BPF task_vma iterator: mm_struct used without a reference, freed under the iteratorCVE-2026-53085 · Linux kernel BPF (open-coded task_vma iterator, mm_struct lifecycle)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High