Linux: Return of Wrong Status Code
CVE-2026-53092 is a high-severity return of wrong status code vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 1509c1ae9185ec7103899967ed788b6eebab3fcc, d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066, cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 1509c1ae9185ec7103899967ed788b6eebab3fcc or d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066 or cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de or d7f14173c0d5866c3cae759dee560ad1bed10d2e, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.18.33 or 7.0.10, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 98d7ca374ba4b39e7535613d40e159f09ca14da2 up to, but not including, 1509c1ae9185ec7103899967ed788b6eebab3fcc; 98d7ca374ba4b39e7535613d40e159f09ca14da2 up to, but not including, d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066; 98d7ca374ba4b39e7535613d40e159f09ca14da2 up to, but not including, cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de; 98d7ca374ba4b39e7535613d40e159f09ca14da2 up to, but not including, d7f14173c0d5866c3cae759dee560ad1bed10d2e; 6.11 | 1509c1ae9185ec7103899967ed788b6eebab3fcc, d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066, cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de, d7f14173c0d5866c3cae759dee560ad1bed10d2e |
| Red Hat | Red Hat Enterprise Linux 10 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 6 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 7 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9 | Not specified in the record | Not stated |
| Linux | Linux Kernel | 6.11 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.10 | 6.18.33, 7.0.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 6.4 | Medium | CNA |
Official description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Return of Wrong Status Code
A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Third-party and government advisories
- access.redhat.com/security/cve/CVE-2026-53092Third Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2492362Third Party Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53092.jsonThird Party Advisory
Other references
Recent Return of Wrong Status Code vulnerabilities
- 8.1 High severity
Spotted an error? Tell us.