CyberSecBulletin
CVE-2026-53078NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-53078 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions db1200ec2c3ddf119d4d9ba67982063df06bbacb, 4c1c5efd9d1d74743d41ce4e1600501b4feb6827, 0e6b30657bbc771f38025c828d722b6162428508 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to db1200ec2c3ddf119d4d9ba67982063df06bbacb or 4c1c5efd9d1d74743d41ce4e1600501b4feb6827 or 0e6b30657bbc771f38025c828d722b6162428508 or 64eaf4ecda007140ddcdb28e00c48c9c69aaba39, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.5 or 5.8 or 5.9 or 7.0.10, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxfd09af010788a884de1c39537c288830c3d305db up to, but not including, db1200ec2c3ddf119d4d9ba67982063df06bbacb; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 4c1c5efd9d1d74743d41ce4e1600501b4feb6827; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 0e6b30657bbc771f38025c828d722b6162428508; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 64eaf4ecda007140ddcdb28e00c48c9c69aaba39; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 2a2c98141e0a75f2d4a7d78b0316c88b3da784ac; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 22400725de070b787cd6d806c5795370ab46d269; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 18e3ffde1822f0b48b1753bf34aa97ce839df1d8; fd09af010788a884de1c39537c288830c3d305db up to, but not including, 10f86a2a5c91fc4c4d001960f1c21abe52545ef6; and 9 more rangesdb1200ec2c3ddf119d4d9ba67982063df06bbacb, 4c1c5efd9d1d74743d41ce4e1600501b4feb6827, 0e6b30657bbc771f38025c828d722b6162428508, 64eaf4ecda007140ddcdb28e00c48c9c69aaba39, 2a2c98141e0a75f2d4a7d78b0316c88b3da784ac, 22400725de070b787cd6d806c5795370ab46d269
LinuxLinux Kernel5.4.61 up to, but not including, 5.5; 5.7.18 up to, but not including, 5.8; 5.8.4 up to, but not including, 5.9; 5.9.1 up to, but not including, 7.0.10; 5.95.5, 5.8, 5.9, 7.0.10

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.