CVE-2026-31525

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN

The BPF interpreter's signed 32-bit division and modulo handlers use

the kernel abs() macro on s32 operands. The abs() macro documentation

(include/linux/math.h) explicitly states the result is undefined when

the input is the type minimum. When DST contains S32_MIN (0x80000000),

abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged

on arm64/x86. This value is then sign-extended to u64 as

0xFFFFFFFF80000000, causing do_div() to compute the wrong result.

The verifier's abstract interpretation (scalar32_min_max_sdiv) computes

the mathematically correct result for range tracking, creating a

verifier/interpreter mismatch that can be exploited for out-of-bounds

map value access.

Introduce abs_s32() which handles S32_MIN correctly by casting to u32

before negating, avoiding signed overflow entirely. Replace all 8

abs((s32)...) call sites in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References