The Linux kernel contained a vulnerability (CVE-2026-53095) in the BPF subsystem where freplace uprobe programs, which share the same program type as kprobe, could abuse kprobe_write_ctx to modify the struct pt_regs. This allowed the first argument of kernel functions attached by kprobe to be forcibly set to zero during execution. The fix prevents attaching freplace programs on kprobe programs when their kprobe_write_ctx values differ, thereby blocking this abuse. The vulnerability affects multiple versions of the linux-hwe-edge kernel prior to 7.0.0-28.28 and related versions. The issue is resolved in updated kernel packages provided by Ubuntu.

An attacker with local privileges could exploit this vulnerability to manipulate kernel function arguments, potentially causing denial of service or other disruptions due to unexpected kernel behavior. The CVSS vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. There are no known exploits in the wild at this time.

A patch is available and has been released by Ubuntu in updated linux-image packages for affected kernel versions. Users should apply the updates and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor advisory instructions for updating to the fixed kernel versions.