CVE-2026-53106

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Do not allow deleting local storage in NMI<br /> <br /> Currently, local storage may deadlock when deferring freeing selem or<br /> local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace()<br /> in NMI or reentrant. Since deleting selem in NMI is an unlikely use<br /> case, partially mitigate it by returning error when calling from<br /> bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible<br /> to deadlock through reentrant. A full mitigation requires returning<br /> error when irqs_disabled() is true, which, however is too heavy-handed<br /> for bpf_xxx_storage_delete().<br /> <br /> The long-term solution requires _nolock versions of call_rcu. Another<br /> possible solution is to defer the free through irq_work [0], but it<br /> would grow the size of selem, which is non-ideal.<br /> <br /> The check is only needed in bpf_selem_unlink(), which is used by helpers<br /> and syscalls. bpf_selem_unlink_nofail() is fine as it is called during<br /> map and owner tear down that never run in NMI or reentrant.<br /> <br /> [0] https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com/