CVE-2026-98132: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
In the Linux kernel, the following vulnerability has been resolved:
bpf: don't downgrade half-dead scalar zero spills to STACKZERO
states.c:cleanfuncstate() can downgrade scalar zero spill to STACKZERO in the following case:
(u64 )(r10 - 8) = 0; ... checkpoint ... r1 = (u32 )(r10 - 4); ... no reads from r10-8 ...
Here 4 bytes at r10-8 are dead and verifier changes scalar spill to a combination: 0000pppp (p stands for poison). Such a change breaks precision propagation chains. All places that produce STACKZERO should call bpfmarkchainprecision() for the zero source.
This patch fixes the bug in a simplest way possible: avoids converting stack spills of zero to STACKZERO. Two smarter approaches are possible: - do bpfmarkchainprecision() from cleanfuncstate() - check slot liveness information in checkstackwritefixedoff()
I investigated both and the changes required are a bit tricky, hence go with a simple fix for the time being.
Affected Software
Event History
Frequently Asked Questions
What code pattern can trigger the verifier state issue?
The described pattern writes a 64-bit zero value to the BPF stack, passes a checkpoint, then reads only the upper 32 bits of that stack slot. If the original full-slot value is no longer read, the verifier can treat part of the slot as dead and convert the spill into a mixed zero-and-poison state.
What is the stated effect of the incorrect state conversion?
The conversion can break precision-propagation chains in the BPF verifier. The fix avoids converting zero-valued stack spills to STACK_ZERO in this case.
How can I determine whether a kernel includes the fix?
The supplied references identify stable commits 436fa689630b741a77ef8c4a6f426479affd5bac and 2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e. No affected or fixed kernel release versions are provided.