CVE-2026-31413 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1. For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0. The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access. Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been addressed. The issue arose in the BPF verifier's scalar forking logic, specifically within the 'maybe_fork_scalars()' function. This function is invoked for both BPF_AND and BPF_OR operations when the source operand is a constant. The vulnerability occurs when the destination operand (dst) has a signed range of [-1, 0]. In this scenario, the verifier state is forked incorrectly: the pushed path receives dst = 0, while the current path gets dst = -1. This behavior is correct for BPF_AND, but problematic for BPF_OR, leading to a divergence between the verifier's analysis and the actual runtime behavior. Consequently, this divergence can be exploited to access BPF maps out of bounds, potentially causing undefined behavior or crashes.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.12.75, < 6.12.80 >= 6.18.16, < 6.18.21 >= 6.19.6, < 6.19.11 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 20, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 12, 2026 | New CVE Received | kernel.org |