Linux Kernel Vulnerability in BPF Storage Cloning Mechanism

CVE-2026-52938

What is CVE-2026-52938?

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) storage mechanism can lead to a NULL pointer dereference during concurrent operations. This issue arises when the bpf_selem_unlink_nofail() function sets the smap attribute of a selem to NULL before its removal, allowing a simultaneous RCU (Read-Copy-Update) reader in bpf_sk_storage_clone() to access a now-invalid memory location. This can lead to a general protection fault and possible system instability. The resolution includes adding a NULL check for the smap attribute to prevent such dereferencing errors in affected code paths.

References