CVE-2026-93127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop scalar id on sign-extending narrowing stack fills

When a spilled scalar is filled back with a sign-extending narrowing load

(BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register

including its scalar id, but coerce_reg_to_size_sx() then sign-extends the

filled register's value. If the same slot is also filled with a plain

zero-extending load (BPF_MEM), both destination registers share the id yet

hold different values. A later 'if <zext-reg> == const' then refines the

sign-extended register through sync_linked_regs() to a value it does not

have at runtime (e.g. the verifier believes 0x80000000 while the register

is 0xffffffff80000000), which can be turned into an out-of-bounds access.

Drop the shared scalar id at the sign-extension site in check_mem_access()

when sign extension actually changes the value, mirroring the BPF_MOVSX

handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References