Linux kernel BPF: sock_ops same-register context access leaks a kernel pointer and reads out of bounds

Impact

When a sock_ops BPF program accesses a context field with dst_reg == src_reg, the rewrite macros fail to zero the destination on the !fullsock / !locked_tcp_sock path, leaving the stale context pointer in the register. Through SOCK_OPS_GET_SK the verifier treats that as PTR_TO_SOCKET_OR_NULL, so a bogus socket pointer can be handed to helpers such as bpf_skc_to_tcp6_sock() and produce a stack out-of-bounds access; through SOCK_OPS_GET_FIELD the same pointer is returned as a SCALAR_VALUE, leaking a kernel address and defeating KASLR. This matters on GPU nodes running eBPF-based CNI, service mesh or observability agents, where the ability to load sock_ops programs is delegated. Exploitation needs local privileges sufficient to load BPF (CAP_BPF/CAP_NET_ADMIN or root), so an ordinary unprivileged GPU pod cannot reach it unless BPF loading has been granted to tenants.

Who can reach it

Local user or container able to load a sock_ops BPF program - in practice CAP_BPF plus CAP_NET_ADMIN, or root in a privileged sidecar. Not reachable from the network and not reachable from a default unprivileged tenant pod.

What to do

Take the stable-kernel update carrying this fix (the referenced git commits) and reboot each affected node, which on a GPU fleet means draining and rebooting - budget a rolling maintenance pass. In the meantime, the practical mitigation is to stop granting CAP_BPF/CAP_NET_ADMIN to tenant workloads and keep BPF program loading to trusted platform agents. No fixed release number is given in the record beyond the linked stable commits.

References

Related entries

• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel list_lru: cgroup teardown race lets two CPUs unlink the same list item under different locksCVE-2026-53153 · Linux kernel mm/list_lru (memcg reparenting on cgroup teardown)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High