CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop scalar id on sign-extending narrowing stack fills

When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled registers value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later if == const then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access.

Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

Affected Software

References

• https://git.kernel.org/stable/c/2cb5f4ca695ebe552647e5ba4aad6934d6a43bae
• https://git.kernel.org/stable/c/f3614622dc41f3dd99bb4f691da253814e4e6cae