HIGH Introduced in 7.0
bpf Verifier Bypass
CVE-2026-93127
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later 'if <zext-reg> == const' then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access. Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).
02KernelScan AI Analysis
Risk summary
A BPF verifier bug allows a malicious BPF program to bypass bounds checks by exploiting shared scalar IDs between sign-extended and zero-extended stack fills, leading to out-of-bounds memory access. This can be triggered by an unprivileged user if unprivileged BPF is enabled, or by a user with CAP_BPF otherwise.
Vulnerability analysis
The BPF verifier incorrectly preserves a shared scalar ID when a spilled register is loaded back with a sign-extending narrowing load, even though sign extension changes the value relative to a zero-extending load of the same slot. Because both destination registers share the ID, a later conditional comparison refines the sign-extended register's bounds to a value it does not actually hold at runtime, allowing the verifier to approve out-of-bounds memory accesses. The fix drops the shared scalar ID when sign extension actually changes the value, preventing incorrect bounds propagation between the linked registers. This is reachable by any user who can load BPF programs—unprivileged users if unprivileged BPF is enabled, or users with CAP_BPF otherwise.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.6 | f3614622dc41 |
| mainline | 7.0 | 7.3 | 2cb5f4ca695e |