CVE-2026-93127: bpf: Drop scalar id on sign-extending narrowing stack fills
In the Linux kernel, the following vulnerability has been resolved:
bpf: Drop scalar id on sign-extending narrowing stack fills
When a spilled scalar is filled back with a sign-extending narrowing load (BPFMEMSX), checkstackreadfixedoff() copies the spilled register including its scalar id, but coerceregtosizesx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPFMEM), both destination registers share the id yet hold different values. A later 'if <zext-reg> == const' then refines the sign-extended register through synclinkedregs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access.
Drop the shared scalar id at the sign-extension site in checkmemaccess() when sign extension actually changes the value, mirroring the BPFMOVSX handling in checkaluop() (nosext = regumax < 2^(size8-1)).
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the verifier inconsistency?
A BPF program must spill a scalar to the stack, reload the same slot through both a sign-extending narrowing BPF_MEMSX load and a plain zero-extending BPF_MEM load, and use a comparison that causes linked-register refinement. The sign extension must actually change the value; the described example involves a value with the narrowing width's sign bit set.
What is the potential impact if the issue is exploited?
The verifier can infer a value for the sign-extended register that differs from its runtime value. This incorrect verification state can be turned into an out-of-bounds access.
How is the issue resolved?
The fix drops the shared scalar ID when a sign-extending stack fill changes the value, preventing the zero-extended and sign-extended registers from being treated as linked values. The provided references identify stable kernel commits containing the resolution.