Linux bpf devmap: non-RCU hash iteration in the XDP broadcast redirect path can read a half-built entry

Impact

The DEVMAP_HASH branch of dev_map_redirect_multi() walked the hash bucket with hlist_for_each_entry_safe() while running under RCU in softirq context, so it dereferenced pointers without the acquire barrier that pairs with the writers' rcu_assign_pointer(). On weakly-ordered CPUs - arm64 and POWER, which covers Grace and Ampere nodes - a reader can observe a partially constructed devmap entry during an XDP broadcast redirect. It also defeated lockdep RCU validation and KCSAN, so the class of bug was invisible to the usual testing. This path is live on nodes running XDP-based CNI or load balancing (Cilium and similar), where devmap updates happen while traffic is being redirected. The published record is an ordering and annotation fix; it does not demonstrate a working exploit, and reaching it requires the ability to load XDP programs and update devmaps, which is a privileged operation on a normal node.

Who can reach it

Local and privileged in practice - loading XDP/devmap programs and updating devmap entries needs CAP_BPF/CAP_NET_ADMIN. The race is then driven by in-flight network traffic hitting the broadcast redirect while the map is updated.

What to do

Update to a stable kernel that switches to hlist_for_each_entry_rcu() with rcu_read_lock_bh_held() and drops the bogus lockdep_is_held(&dtab->index_lock) condition in dev_map_enqueue_multi(). No userspace workaround beyond not using DEVMAP_HASH broadcast redirect. Drain and reboot nodes, prioritising arm64 and POWER hosts where the missing barrier actually matters.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel list_lru: cgroup teardown race lets two CPUs unlink the same list item under different locksCVE-2026-53153 · Linux kernel mm/list_lru (memcg reparenting on cgroup teardown)High
• Linux mm: file-backed THP split reads folio state after dropping the last referenceCVE-2026-53189 · Linux kernel mm/huge_memory (__split_huge_pmd_locked RSS accounting)High
• Linux io_uring: bundle recv drops IORING_CQE_F_BUF_MORE, so userspace advances past a buffer the kernel still usesCVE-2026-53191 · Linux kernel io_uring/net (bundle recv, IORING_CQE_F_BUF_MORE inheritance)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGESCVE-2026-53362 · Linux kernel IPv6 (__ip6_append_data paged allocation path)High