Riskcovery

CVE-2026-53031

bpf: Validate node_id in arena_alloc_pages()

State
Published
Severity
7.8 High
Published
Jun 24, 2026
Updated
Oct 19, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Validate node_id in arena_alloc_pages()

arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in arena_alloc_pages().

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
LinuxLinux
  • 317460317a02a1af512697e6e964298dedd8a163 to before 31d3b4b28e55835646d6829d60023f730dd34e85Affected
  • 317460317a02a1af512697e6e964298dedd8a163 to before e15900888c09480a4c632bc598f1c5bd39bed6d6Affected
  • 317460317a02a1af512697e6e964298dedd8a163 to before fb66e20130f95a93ffea1677252526a9e39170b2Affected
  • 317460317a02a1af512697e6e964298dedd8a163 to before 2845989f2ebaf7848e4eccf9a779daf3156ea0a5Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.91 through 6.12.*Not affected
  • 6.18.33 through 6.18.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.