CVE-2026-93127 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Drop scalar id on sign-extending narrowing stack fills
When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later 'if <zext-reg> == const' then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access.
Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Berkeley Packet Filter subsystem contains a critical logic flaw within its verifier component that can lead to out-of-bounds memory access. This vulnerability arises from an inconsistency in how scalar identifiers are managed during register state tracking, specifically when handling sign-extending narrowing loads versus zero-extending loads on the same stack slot. The BPF verifier is responsible for ensuring that all eBPF programs are safe before they are loaded into the kernel, preventing malicious or buggy code from causing system crashes or privilege escalation. However, in this specific scenario, the verifier fails to correctly invalidate shared scalar identifiers when register values diverge due to different extension behaviors, leading to incorrect assumptions about data ranges and potential security bypasses.
The technical root cause lies in the interaction between check_stack_read_fixed_off() and coerce_reg_to_size_sx(). When a spilled scalar is read back from the stack using a sign-extending narrowing load instruction, identified as BPF_MEMSX, the verifier copies the register state including its unique scalar identifier to maintain tracking of related values. Subsequently, the function coerce_reg_to_size_sx() performs the actual sign-extension on the filled register's value. The problem occurs when the same stack slot is subsequently accessed using a plain zero-extending load instruction, BPF_MEM. In this case, both destination registers end up sharing the same scalar identifier despite holding fundamentally different values due to their distinct extension methods. This shared identity implies equivalence where none exists in reality.
This discrepancy triggers a dangerous chain of events during subsequent verification steps. If a later conditional branch compares the zero-extended register against a constant value using an instruction like if <zext-reg> == const, the verifier attempts to refine the state of other registers sharing that scalar identifier through sync_linked_regs(). Because the verifier assumes equivalence based on the shared ID, it incorrectly refines the sign-extended register. For example, the verifier might conclude that the sign-extended register holds a value like 0x80000000 when its actual runtime value is significantly larger, such as 0xffffffff80000000. This false narrowing of the value range allows an attacker to craft eBPF programs that bypass bounds checks, ultimately leading to out-of-bounds memory accesses which can be exploited for arbitrary code execution or denial of service attacks against the host system.
The resolution involves modifying check_mem_access() to drop the shared scalar identifier at the point where sign extension actually alters the value. This approach mirrors the handling logic already present in check_alu_op() for BPF_MOVSX instructions, which checks if no sign extension is needed by verifying that reg_umax is less than 2^(size*8-1). By invalidating the scalar ID when a divergence occurs due to sign-extension, the verifier ensures that registers with different values are not incorrectly treated as equivalent. This prevents the erroneous refinement of register states and maintains the integrity of range checks throughout program verification.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to correctly validate state consistency in complex data structures. It also relates to CWE-682 Incorrect Calculation, as the verifier miscalculates the possible values of registers due to flawed identity tracking. In terms of attack vectors and techniques, this flaw could be leveraged within an ATT&CK framework context under T1059 Command and Scripting Interpreter via eBPF programs, allowing for privilege escalation if exploited by a user with permission to load unprivileged or privileged BPF programs depending on kernel configuration.
To mitigate the risk associated with this vulnerability, system administrators should ensure that Linux kernels are updated to versions containing the patch for bpf: Drop scalar id on sign-extending narrowing stack fills. Since eBPF is often used in security-sensitive contexts such as network filtering and tracing, maintaining up-to-date kernel packages is essential. Additionally, organizations deploying containerized workloads or cloud-native applications should verify that their base images include patched kernels to prevent exploitation of this logic error for lateral movement or privilege escalation within virtualized environments.