Linux kernel BPF offload: dev-bound program freed while offload->prog still points at it

Impact

A dev-bound-only XDP program (BPF_F_XDP_DEV_BOUND_ONLY) JIT-compiled with constant blinding enabled gets cloned, and bpf_jit_prog_release_other() updates aux->prog to the clone but not offload->prog. The original is freed, leaving offload->prog dangling. When the network namespace is later torn down, cleanup_net() reaches __bpf_prog_offload_destroy() on the freed program and faults - the commit message includes the page-fault trace and a reliable reproducer using the xdp_metadata selftest. The preconditions are narrow and specific: net.core.bpf_jit_harden must be 2 or higher, and the program must be dev-bound-only, which is the unusual combination of a hardening setting some operators do enable and an XDP offload feature most do not use. Check whether bpf_jit_harden is set to 2 on your nodes before spending a window on this; if it is 0 or 1 you are not exposed.

Who can reach it

Local. Requires loading a dev-bound-only XDP program on a host with bpf_jit_harden >= 2, so CAP_BPF/CAP_NET_ADMIN, plus a netns teardown to trigger the fault. Not reachable from the network or from a tenant without those capabilities.

What to do

Patch to a fixed stable kernel - the fix keeps offload->prog in sync alongside aux->prog - and reboot. A zero-reboot mitigation exists and is worth knowing: setting net.core.bpf_jit_harden below 2 removes the constant-blinding clone that creates the stale pointer, though it also gives up that hardening. Decide which you would rather hold until the next kernel window.

References

Related entries

• Linux bpf devmap: non-RCU hash iteration in the XDP broadcast redirect path can read a half-built entryCVE-2026-53096 · Linux kernel bpf devmap (dev_map_redirect_multi, DEVMAP_HASH SKB path)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel list_lru: cgroup teardown race lets two CPUs unlink the same list item under different locksCVE-2026-53153 · Linux kernel mm/list_lru (memcg reparenting on cgroup teardown)High
• Linux mm: file-backed THP split reads folio state after dropping the last referenceCVE-2026-53189 · Linux kernel mm/huge_memory (__split_huge_pmd_locked RSS accounting)High
• Linux io_uring: bundle recv drops IORING_CQE_F_BUF_MORE, so userspace advances past a buffer the kernel still usesCVE-2026-53191 · Linux kernel io_uring/net (bundle recv, IORING_CQE_F_BUF_MORE inheritance)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High