CVE-2026-45933

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve id of register in sync_linked_regs()

sync_linked_regs() copies the id of known_reg to reg when propagating

bounds of known_reg to reg using the off of known_reg, but when

known_reg was linked to reg like:

known_reg = reg ; both known_reg and reg get same id

known_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST

now when a call to sync_linked_regs() happens, let's say with the following:

if known_reg >= 10 goto pc+2

known_reg's new bounds are propagated to reg but now reg gets

BPF_ADD_CONST from the copy.

This means if another link to reg is created like:

another_reg = reg ; another_reg should get the id of reg but

assign_scalar_id_before_mov() sees

BPF_ADD_CONST on reg and assigns a new id to it.

As reg has a new id now, known_reg's link to reg is broken. If we find

new bounds for known_reg, they will not b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References