---
id: CVE-2026-53076
title: 'bpf: Fix OOB in pcpu_init_value'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix OOB in pcpu_init_value

  An out-of-bounds read occurs when copying element from a
  BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the
  same value_size t…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db <
    e19c5ed9f1922a6854073f8651a63fa7be26e9e9
  - >-
    Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db <
    e0378419b0e20178b5d100b27c9cc7e51064202e
  - >-
    Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db <
    6086079e6d1c32ba4c4b422612b8aebb1129a96c
  - >-
    Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db <
    634a793d0e1c822412095d25a1338f8831ad894c
  - >-
    Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db <
    576afddfee8d1108ee299bf10f581593540d1a36
  - Linux c602ad2b52dcbca5af08e5137bd5575c039b52e3
  - Linux ab68b940dd6f7b5f8e2557937162dcb8a0583a05
  - Linux >= 5.4.78 < 5.5
  - Linux >= 5.9.9 < 5.10
  - Linux 5.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:25:17.354262Z'
published: '2026-06-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:31.024Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53076'
references:
  - url: 'https://git.kernel.org/stable/c/e19c5ed9f1922a6854073f8651a63fa7be26e9e9'
  - url: 'https://git.kernel.org/stable/c/e0378419b0e20178b5d100b27c9cc7e51064202e'
  - url: 'https://git.kernel.org/stable/c/6086079e6d1c32ba4c4b422612b8aebb1129a96c'
  - url: 'https://git.kernel.org/stable/c/634a793d0e1c822412095d25a1338f8831ad894c'
  - url: 'https://git.kernel.org/stable/c/576afddfee8d1108ee299bf10f581593540d1a36'
tags:
  - cve.org
epss: 0.00117
epssPercentile: 0.01533
ingestedAt: '2026-10-16T17:24:46.729Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix OOB in pcpu_init_value

An out-of-bounds read occurs when copying element from a
BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the
same value_size that is not rounded up to 8 bytes.

The issue happens when:
1. A CGROUP_STORAGE map is created with value_size not aligned to
   8 bytes (e.g., 4 bytes)
2. A pcpu map is created with the same value_size (e.g., 4 bytes)
3. Update element in 2 with data in 1

pcpu_init_value assumes that all sources are rounded up to 8 bytes,
and invokes copy_map_value_long to make a data copy, However, the
assumption doesn't stand since there are some cases where the source
may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data.
the verifier verifies exactly the size that the source claims, not
the size rounded up to 8 bytes by kernel, an OOB happens when the
source has only 4 bytes while the copy size(4) is rounded up to 8.

## Affected

- `Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db < e19c5ed9f1922a6854073f8651a63fa7be26e9e9`
- `Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db < e0378419b0e20178b5d100b27c9cc7e51064202e`
- `Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db < 6086079e6d1c32ba4c4b422612b8aebb1129a96c`
- `Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db < 634a793d0e1c822412095d25a1338f8831ad894c`
- `Linux >= d3bec0138bfbe58606fc1d6f57a4cdc1a20218db < 576afddfee8d1108ee299bf10f581593540d1a36`
- `Linux c602ad2b52dcbca5af08e5137bd5575c039b52e3`
- `Linux ab68b940dd6f7b5f8e2557937162dcb8a0583a05`
- `Linux >= 5.4.78 < 5.5`
- `Linux >= 5.9.9 < 5.10`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.