CVE-2026-53036: bpf, arm64: Fix off-by-one in check_imm signed range check
bpf, arm64: Fix off-by-one in checkimm signed range check
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernel (bpf, arm64)to a version that resolves this vulnerability.Patch bpf, arm64: Fix off-by-one in check_imm signed range check - Configuration
Apply the fix described as "bpf, arm64: Fix off-by-one in check_imm signed range check" so the B/B.cond and CBZ/CBNZ encodings only accept immediates that fit the signed imm19 field as [-2^18, 2^18) / [2^18, 2^19) per the enforced N-bit range, preventing values in [2^18, 2^19) from slipping past.
arm64 BPF JIT check_imm(bits, imm) signed-range check = enforce the signed N-bit immediate range [-2^(N-1), 2^(N-1)) rather than the off-by-one (N+1)-bit range [-2^N, 2^N) - Compensating control
After applying the kernel fix, ensure affected arm64 BPF programs that rely on branch displacement/CBZ/CBNZ encoding are recompiled/reloaded so the corrected imm-range check is exercised (prevents execution of branches with immediates that could previously bypass check_imm19).
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the arm64 BPF JIT. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What access does an attacker need to exploit it?
The supplied severity vector indicates local access, low privileges, and no user interaction are required. Exploitation involves reaching the arm64 BPF JIT branch-displacement handling path with an immediate value that passes the faulty range check.
What is the practical impact of the incorrect range check?
Out-of-range branch displacements can be accepted and then truncated when encoded. For conditional branches using imm19, this can turn an intended forward branch into a backward branch; the same issue class affects B/BL imm26 encodings.
What is the remediation?
Apply a kernel update containing the fix that changes the signed immediate validation to shift by bits minus one rather than bits. The provided references identify stable kernel commits for the fix.