CVE-2026-53096

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path<br /> <br /> The DEVMAP_HASH branch in dev_map_redirect_multi() uses<br /> hlist_for_each_entry_safe() to iterate hash buckets, but this function<br /> runs under RCU protection (called from xdp_do_generic_redirect_map()<br /> in softirq context). Concurrent writers (__dev_map_hash_update_elem,<br /> dev_map_hash_delete_elem) modify the list using RCU primitives<br /> (hlist_add_head_rcu, hlist_del_rcu).<br /> <br /> hlist_for_each_entry_safe() performs plain pointer dereferences without<br /> rcu_dereference(), missing the acquire barrier needed to pair with<br /> writers&amp;#39; rcu_assign_pointer(). On weakly-ordered architectures (ARM64,<br /> POWER), a reader can observe a partially-constructed node. It also<br /> defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race<br /> detection.<br /> <br /> Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()<br /> as the lockdep condition, consistent with the rcu_dereference_check()<br /> used in the DEVMAP (non-hash) branch of the same functions. Also fix<br /> the same incorrect lockdep_is_held(&amp;dtab-&gt;index_lock) condition in<br /> dev_map_enqueue_multi(), where the lock is not held either.