CVE-2026-53083

bpf: Fix RCU stall in bpf_fd_array_map_clear()

MEDIUM
5.5
CVSS Score
Published: June 24, 2026 at 04:30 PM UTC
Updated: October 30, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix RCU stall in bpf_fd_array_map_clear() Add a missing cond_resched() in bpf_fd_array_map_clear() loop. For PROG_ARRAY maps with many entries this loop calls prog_array_map_poke_run() per entry which can be expensive, and without yielding this can cause RCU stalls under load: rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 30932 Comm: kworker/0:2 Not tainted 6.14.0-13195-g967e8def1100 #2 PREEMPT(undef) Workqueue: events prog_array_map_clear_deferred RIP: 0010:write_comp_data+0x38/0x90 kernel/kcov.c:246 Call Trace: <TASK> prog_array_map_poke_run+0x77/0x380 kernel/bpf/arraymap.c:1096 __fd_array_map_delete_elem+0x197/0x310 kernel/bpf/arraymap.c:925 bpf_fd_array_map_clear kernel/bpf/arraymap.c:1000 [inline] prog_array_map_clear_deferred+0x119/0x1b0 kernel/bpf/arraymap.c:1141 process_one_work+0x898/0x19d0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x770/0x10b0 kernel/workqueue.c:3400 kthread+0x465/0x880 kernel/kthread.c:464 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x19/0x30 arch/x86/entry/entry_64.S:245 </TASK>

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.5 ≤ v < 6.6.1416.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.7 ≤ v < 6.12.915.5da765a2f599304a81a25e77908d1790414ecdbb6
Vendor states this is fixed in 4406942e65ca128c56c67443832988873c21d2e9 (fixed)
Vendor states this is fixed in 67bdb4b0d26f2d6bbf1798a925ef5a3b9ed7357a (fixed)
Vendor states this is fixed in 71ddb7defc442ab38c53123c384fedbfd8410a15 (fixed)
Vendor states this is fixed in b1f7158a86f3cbac4d5a32beb55ca0f8027d44cd (fixed)
Vendor states this is fixed in e1ed678855e315f90c70c1723e94157a9a82e660 (fixed)
Vendor states this is fixed in 5.5 (unaffected)
Vendor states this is fixed in 6.1.191 (unaffected)
Vendor states this is fixed in 6.12.91 (unaffected)
Vendor states this is fixed in 6.18.33 (unaffected)
Vendor states this is fixed in 6.6.141 (unaffected)
Vendor states this is fixed in 7.0.10 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card