bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
Summary
| CVE | CVE-2026-31413 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-12 06:16:20 UTC |
| Updated | 2026-05-20 15:49:24 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1. For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0. The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access. Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.000100000 probability, percentile 0.011130000 (date 2026-04-27)
Problem Types: CWE-125
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected dea9989a3f3961faede93752cd81eb5a9514d911 342aa1ee995ef5bbf876096dc3a5e51218d76fa4 git | Not specified |
| CNA | Linux | Linux | affected 4c122e8ae14950cf6b59d208fc5160f7c601e746 58bd87d0e69204dbd739e4387a1edb0c4b1644e7 git | Not specified |
| CNA | Linux | Linux | affected e52567173ba86dbffb990595fbe60e2e83899372 d13281ae7ea8902b21d99d10a2c8caf0bdec0455 git | Not specified |
| CNA | Linux | Linux | affected bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 c845894ebd6fb43226b3118d6b017942550910c5 git | Not specified |
| CNA | Linux | Linux | affected 6.12.75 6.12.80 semver | Not specified |
| CNA | Linux | Linux | affected 6.18.16 6.18.21 semver | Not specified |
| CNA | Linux | Linux | affected 6.19.6 6.19.11 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.