CVE-2026-53099
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI
This was renamed in commit 23ef9d439769 ("kcfi: Rename CONFIG_CFI_CLANG
to CONFIG_CFI") as it is now a compiler-agnostic option. Using the wrong
name results in the code getting compiled out. Meaning the CFI failures
for btf_dtor_kfunc_t would still trigger.
Summary dbcve.org
The Linux kernel's BPF subsystem used the deprecated CONFIG_CFI_CLANG option name instead of the renamed CONFIG_CFI option. Since the config symbol was renamed to be compiler-agnostic, the CFI protection code for btf_dtor_kfunc gets compiled out entirely, leaving this code path without Control Flow Integrity protection despite appearing to be enabled.
Mitigation
Rebuild the kernel with the correct CONFIG_CFI option and verify CFI protections are actively enforced for the btf_dtor_kfunc code path using kernel CFI testing utilities.