CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix linked reg delta tracking when srcreg == dstreg
Consider the case of rX += rX where srcreg and dstreg are pointers to the same bpfregstate in adjustregminmaxvals(). The latter first modifies the dstreg in-place, and later in the delta tracking, the subsequent isregconst(srcreg)/regconstvalue(srcreg) reads the post-{add,sub} value instead of the original source.
This is problematic since it sets an incorrect delta, which synclinkedregs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Compensating control
Skip the corner case where src_reg == dst_reg in adjust_reg_min_max_vals() to avoid incorrect linked-register delta tracking.