CVE-2026-93127

Status: UPDATED  |  Advisory ID: CVE-2026-93127

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop scalar id on sign-extending narrowing stack fills

When a spilled scalar is filled back with a sign-extending narrowing load

(BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register

including its scalar id, but coerce_reg_to_size_sx() then sign-extends the

filled register's value. If the same slot is also filled with a plain

zero-extending load (BPF_MEM), both destination registers share the id yet

hold different values. A later 'if <zext-reg> == const' then refines the

sign-extended register through sync_linked_regs() to a value it does not

have at runtime (e.g. the verifier believes 0x80000000 while the register

is 0xffffffff80000000), which can be turned into an out-of-bounds access.

Drop the shared scalar id at the sign-extension site in check_mem_access()

when sign extension actually changes the value, mirroring the BPF_MOVSX

handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References