CVE-2026-53110 (GCVE-0-2026-53110)
Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
EPSS
VEX
Title
s390/bpf: Zero-extend bpf prog return values and kfunc arguments
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/bpf: Zero-extend bpf prog return values and kfunc arguments
s390x ABI requires callers to zero-extend unsigned arguments and
sign-extend signed arguments, and callees to zero-extend unsigned
return values and sign-extend signed return values.
s390 BPF JIT currently implements only sign extension. Fix this
omission and implement zero extension too.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
528eb2cb87bc1353235a6384696b4849bde8b0ba , < edc90a12073b9a530064a99945c183dde120cb99
(git)
Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 44c4f999b03f55debb1a0c5ab5c1796895a1adf8 (git) Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 366b0e05ee24f5ba62bdc7ec1346038258b9a797 (git) Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 834918a77be51419383bf1dda9f02b81ecf26b34 (git) Affected: 528eb2cb87bc1353235a6384696b4849bde8b0ba , < 202e42e4aa890172366354b233c42c73107a3f59 (git) |
guessed | |
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edc90a12073b9a530064a99945c183dde120cb99",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "366b0e05ee24f5ba62bdc7ec1346038258b9a797",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "834918a77be51419383bf1dda9f02b81ecf26b34",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "202e42e4aa890172366354b233c42c73107a3f59",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\n\ns390x ABI requires callers to zero-extend unsigned arguments and\nsign-extend signed arguments, and callees to zero-extend unsigned\nreturn values and sign-extend signed return values.\n\ns390 BPF JIT currently implements only sign extension. Fix this\nomission and implement zero extension too."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:23.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99"
},
{
"url": "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
},
{
"url": "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797"
},
{
"url": "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34"
},
{
"url": "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59"
}
],
"title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53110",
"datePublished": "2026-06-24T16:30:44.036Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-08-05T12:33:23.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-53110",
"date": "2026-10-01",
"epss": "0.0012",
"percentile": "0.01621"
},
"microsoft_vex": {
"current_release_date": "2026-07-09T14:42:15.000Z",
"cve": "CVE-2026-53110",
"id": "msrc_CVE-2026-53110",
"initial_release_date": "2026-06-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53110.json",
"version": "2"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edc90a12073b9a530064a99945c183dde120cb99",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "366b0e05ee24f5ba62bdc7ec1346038258b9a797",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "834918a77be51419383bf1dda9f02b81ecf26b34",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "202e42e4aa890172366354b233c42c73107a3f59",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "681DADD7-FC7E-47E6-AC5C-0E445F6F3E42",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\n\ns390x ABI requires callers to zero-extend unsigned arguments and\nsign-extend signed arguments, and callees to zero-extend unsigned\nreturn values and sign-extend signed return values.\n\ns390 BPF JIT currently implements only sign extension. Fix this\nomission and implement zero extension too."
}
],
"id": "CVE-2026-53110",
"lastModified": "2026-07-23T21:30:15.087",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-06-24T17:17:25.357",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-12T21:00:23+00:00",
"cve": "CVE-2026-53110",
"id": "CVE-2026-53110",
"initial_release_date": "2026-06-24T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53110.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…