---
id: CVE-2026-53096
title: 'bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

  The DEVMAP_HASH branch in dev_map_redirect_multi() uses
  hlist_for_each_entry_safe() to iterate hash bu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    4a3d0fe30b907ff324b1b49756f7e713d67f3645
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    b089aa6e94d7a08e74d076a0fe274842dc9feccc
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    571a05ea1baaccc0dc1e0d227b2cbc978b96d392
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    d4c4bd231ebad70e6f30db429e9640bf378b2f52
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    7027e705062482a8cea43a1c13ede3c35653966f
  - >-
    Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 <
    8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:25:42.393146Z'
published: '2026-06-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:32.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53096'
references:
  - url: 'https://git.kernel.org/stable/c/4a3d0fe30b907ff324b1b49756f7e713d67f3645'
  - url: 'https://git.kernel.org/stable/c/b089aa6e94d7a08e74d076a0fe274842dc9feccc'
  - url: 'https://git.kernel.org/stable/c/571a05ea1baaccc0dc1e0d227b2cbc978b96d392'
  - url: 'https://git.kernel.org/stable/c/cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a'
  - url: 'https://git.kernel.org/stable/c/d4c4bd231ebad70e6f30db429e9640bf378b2f52'
  - url: 'https://git.kernel.org/stable/c/7027e705062482a8cea43a1c13ede3c35653966f'
  - url: 'https://git.kernel.org/stable/c/8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02456
ingestedAt: '2026-10-16T17:24:46.731Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

The DEVMAP_HASH branch in dev_map_redirect_multi() uses
hlist_for_each_entry_safe() to iterate hash buckets, but this function
runs under RCU protection (called from xdp_do_generic_redirect_map()
in softirq context). Concurrent writers (__dev_map_hash_update_elem,
dev_map_hash_delete_elem) modify the list using RCU primitives
(hlist_add_head_rcu, hlist_del_rcu).

hlist_for_each_entry_safe() performs plain pointer dereferences without
rcu_dereference(), missing the acquire barrier needed to pair with
writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64,
POWER), a reader can observe a partially-constructed node. It also
defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race
detection.

Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()
as the lockdep condition, consistent with the rcu_dereference_check()
used in the DEVMAP (non-hash) branch of the same functions. Also fix
the same incorrect lockdep_is_held(&dtab->index_lock) condition in
dev_map_enqueue_multi(), where the lock is not held either.

## Affected

- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < 4a3d0fe30b907ff324b1b49756f7e713d67f3645`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < b089aa6e94d7a08e74d076a0fe274842dc9feccc`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < 571a05ea1baaccc0dc1e0d227b2cbc978b96d392`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < d4c4bd231ebad70e6f30db429e9640bf378b2f52`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < 7027e705062482a8cea43a1c13ede3c35653966f`
- `Linux >= e624d4ed4aa8cc3c69d1359b0aaea539203ed266 < 8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.