CVE-2026-53096

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

The DEVMAP_HASH branch in dev_map_redirect_multi() uses

hlist_for_each_entry_safe() to iterate hash buckets, but this function

runs under RCU protection (called from xdp_do_generic_redirect_map()

in softirq context). Concurrent writers (__dev_map_hash_update_elem,

dev_map_hash_delete_elem) modify the list using RCU primitives

(hlist_add_head_rcu, hlist_del_rcu).

hlist_for_each_entry_safe() performs plain pointer dereferences without

rcu_dereference(), missing the acquire barrier needed to pair with

writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64,

POWER), a reader can observe a partially-constructed node. It also

defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race

detection.

Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()

as the lockdep condition, consistent with the rcu_dereference_check()

used in the DEVMAP (non-hash) branch of the same functions. Also fix

the same incorrect lockdep_is_held(&dtab->index_lock) condition in

dev_map_enqueue_multi(), where the lock is not held either.