CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding
Published Jun 24, 2026
·Updated
bpf: Fix stale offload->prog pointer after constant blinding
Affected Software
6 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.139.1-1<6.6.143.1-1
6.6.143.1-1
Linux Linux kernel>=6.3<6.6.141
Linux Linux kernel>=6.7<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Enable JIT compilation with constant blinding by setting net.core.bpf_jit_harden=2 (e.g., echo 2 > /proc/sys/net/core/bpf_jit_harden).
Linux kernel (BPF JIT hardening) net.core.bpf_jit_harden = 2 - Compensating control
Run the xdp_metadata selftest (./test_progs -t xdp_metadata) that creates a dev-bound-only XDP program to reproduce/verify the fix for the stale offload->prog pointer issue.
Event History
Jun 24, 2026
CVE Published
via MITRE·04:30 PM
Data Sourced
via MITRE·04:30 PM
DescriptionSeverity
Data Sourced
via NVD·05:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 27, 2026
Data Sourced
via Microsoft·08:07 AM
DescriptionSeverityWeaknessAffected Software