CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   Apply the resolved fix for the BPF sock_ops OOB read and pointer leak: in both SOCK_OPS_GET_FIELD and SOCK_OPS_GET_SK, ensure that when the corresponding check is false (e.g., !fullsock / !locked_tcp_sock paths), the destination register is zeroed even if dst_reg == src_reg, preventing a stale instruction from leaving a bogus ctx pointer that can leak kernel pointers.

   Linux kernel BPF sock_ops (macros SOCK_OPS_GET_FIELD / SOCK_OPS_GET_SK) Fix same-register dst/src handling = Zero dst_reg when dst_reg == src_reg and fullsock/locked checks fail
2. Configuration

   In the fullsock path, change JMP_A(1) to JMP_A(2) so the verifier skips the problematic section that can lead to stack-out-of-bounds access when dst_reg == src_reg.

   Linux kernel BPF sock_ops (fullsock path in SOCK_OPS_GET_SK macro) Jump target after fullsock check = Change JMP_A(1) to JMP_A(2)
3. Configuration

   Fix both macros by inserting BPF_MOV64_IMM(si->dst_reg, 0) after the temporary register use, so dst_reg is explicitly zeroed when the check is false and dst_reg==src_reg would otherwise retain the ctx pointer.

   Linux kernel BPF sock_ops (temp register handling in SOCK_OPS_GET_SK / SOCK_OPS_GET_FIELD) BPF_MOV64_IMM after temp register = Add BPF_MOV64_IMM(si->dst_reg, 0) after the temp register

Event History

Frequently Asked Questions