HIGH Introduced in 7.1
bpf LinkedRegs Bypass
CVE-2026-98042
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collect_linked_regs() check_cond_jmp_op() copies the compared registers into env->{false,true}_reg{1,2} before collect_linked_regs() runs and copies those snapshots back into both branch states afterwards. collect_linked_regs() records at most LINKED_REGS_MAX members of a linked registers group in the jump history and calls clear_scalar_id() for every member that does not fit. The compared register is not exempt from that. As a consequence, sync_linked_regs() might adjust ranges for more registers than bpf_bt_sync_linked_regs() can propagate precision to. Collect the linked registers before the snapshots are taken instead. This might lead to some unnecessary clear_scalar_id's, but from previous testing situations with many linked registers are extremely rare.
02KernelScan AI Analysis
Risk summary
A flaw in the BPF verifier's conditional jump handling allows a crafted program to bypass bounds checks by exploiting inconsistent register metadata tracking. An attacker who can load BPF programs could achieve arbitrary kernel read/write, leading to privilege escalation or container escape. This requires local access and the ability to load BPF programs (CAP_BPF or unprivileged BPF if enabled).
Vulnerability analysis
The BPF verifier evaluates conditional jumps by first saving copies of the registers being compared, then examining related registers to track their value ranges. If the group of related registers grows too large, the verifier strips away identifying metadata for the excess entries. Because the saved copies were made before this stripping occurs, restoring those copies brings the discarded metadata back, causing the verifier to believe registers are more precisely known than they really are. This mismatch lets a carefully constructed BPF program evade bounds checks and perform arbitrary reads and writes of kernel memory. The fix reorders the logic so that related registers are processed and excess metadata is dropped before any snapshots are taken, preventing the discarded information from being restored. The issue is reachable by any local user able to load BPF programs; on most systems this capability can be obtained through a user namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.7 | e821ff19b8ef |
| mainline | 7.1 | 7.3-rc2 | 73a98f96811e |