---
cve: "CVE-2026-53106"
severity: "LOW"
cvss: 3.1
epss: "10%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-24 17:17:24"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T09:47:54+02:00"
---

# CVE-2026-53106

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

bpf: Do not allow deleting local storage in NMI

Currently, local storage may deadlock when deferring freeing selem or
local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace()
in NMI or reentrant. Since deleting selem in NMI is an unlikely use
case, partially mitigate it by returning error when calling from
bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible
to deadlock through reentrant. A full mitigation requires returning
error when irqs_disabled() is true, which, however is too heavy-handed
for bpf_xxx_storage_delete().

The long-term solution requires _nolock versions of call_rcu. Another
possible solution is to defer the free through irq_work [0], but it
would grow the size of selem, which is non-ideal.

The check is only needed in bpf_selem_unlink(), which is used by helpers
and syscalls. bpf_selem_unlink_nofail() is fine as it is called during
map and owner tear down that never run in NMI or reentrant.

[0] https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com/

## Patch verfügbar (OSV)

- Kernel ≥ 7.0.10

## Referenzen

- <https://git.kernel.org/stable/c/e84acaf936970b5b0be2c93bbf255295ba9406df>
- <https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-53106) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_