CVE-2026-31525 (GCVE-0-2026-31525)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:23
VLAI
Title
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result. The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access. Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers. s32 is the only affected case -- the s64 division/modulo handlers do not use abs().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ec0e2da95f72d4a46050a4d994e4fe471474fd80 , < 694ea55f1b1c74f9942d91ec366ae9e822422e42 (git)
Affected: ec0e2da95f72d4a46050a4d994e4fe471474fd80 , < 9ab1227765c446942f290c83382f0b19887c55cf (git)
Affected: ec0e2da95f72d4a46050a4d994e4fe471474fd80 , < f14ca604c0ff274fba19f73f1f0485c0047c1396 (git)
Affected: ec0e2da95f72d4a46050a4d994e4fe471474fd80 , < 0d5d8c3ce45c734aaf3c51cbef59155a6746157d (git)
Affected: ec0e2da95f72d4a46050a4d994e4fe471474fd80 , < c77b30bd1dcb61f66c640ff7d2757816210c7cb0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "694ea55f1b1c74f9942d91ec366ae9e822422e42",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "9ab1227765c446942f290c83382f0b19887c55cf",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "f14ca604c0ff274fba19f73f1f0485c0047c1396",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "0d5d8c3ce45c734aaf3c51cbef59155a6746157d",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "c77b30bd1dcb61f66c640ff7d2757816210c7cb0",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter\u0027s signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier\u0027s abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter\u0027s sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable interpreter code is reached by locally loading and executing a crafted eBPF program through the bpf() syscall, or by attaching/running that program through local BPF interfaces. It is not reachable directly from unauthenticated network packets without first installing attacker-controlled BPF locally.\nAC:L - There is no race or probabilistic prerequisite; the attacker controls the BPF arithmetic operands and can deterministically create the verifier/interpreter mismatch. The interpreter/JIT setting is an affected-deployment precondition, not exploit complexity once present.\nPR:L - A basic local user can reach BPF program and unprivileged map creation on systems with unprivileged BPF enabled for permitted program types such as socket filters. If disabled, higher privileges or delegation are needed, but the highest reasonable affected deployment supports PR:L.\nUI:N - The attacker can load and run or attach the malicious BPF program directly. No victim action is required.\nS:U - The impact is compromise of kernel memory and privileges within the same operating-system security authority. This is standard local kernel privilege escalation rather than a VM or hardware boundary escape.\nC:H - The verifier/interpreter mismatch can be exploited for out-of-bounds BPF map value access. Such map OOB access can disclose kernel memory and be shaped into stronger read primitives.\nI:H - Out-of-bounds map value writes allow kernel memory corruption. In BPF verifier-style bugs, this is defensibly exploitable for arbitrary write, privilege escalation, or control-flow compromise.\nA:H - The same out-of-bounds kernel memory access can corrupt critical state and crash or panic the kernel. The malicious program can be executed repeatedly by the local attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:15.645Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"
        }
      ],
      "title": "bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31525",
    "datePublished": "2026-04-22T13:54:39.144Z",
    "dateReserved": "2026-03-09T15:48:24.111Z",
    "dateUpdated": "2026-08-05T12:23:15.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31525",
      "date": "2026-08-23",
      "epss": "0.00129",
      "percentile": "0.02989"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-29T14:47:28.000Z",
      "cve": "CVE-2026-31525",
      "id": "msrc_CVE-2026-31525",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31525.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31525\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:52.607\",\"lastModified\":\"2026-06-17T10:33:54.867\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\\n\\nThe BPF interpreter\u0027s signed 32-bit division and modulo handlers use\\nthe kernel abs() macro on s32 operands. The abs() macro documentation\\n(include/linux/math.h) explicitly states the result is undefined when\\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\\non arm64/x86. This value is then sign-extended to u64 as\\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\\n\\nThe verifier\u0027s abstract interpretation (scalar32_min_max_sdiv) computes\\nthe mathematically correct result for range tracking, creating a\\nverifier/interpreter mismatch that can be exploited for out-of-bounds\\nmap value access.\\n\\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\\nbefore negating, avoiding signed overflow entirely. Replace all 8\\nabs((s32)...) call sites in the interpreter\u0027s sdiv32/smod32 handlers.\\n\\ns32 is the only affected case -- the s64 division/modulo handlers do\\nnot use abs().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\"lessThan\":\"694ea55f1b1c74f9942d91ec366ae9e822422e42\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\"lessThan\":\"9ab1227765c446942f290c83382f0b19887c55cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\"lessThan\":\"f14ca604c0ff274fba19f73f1f0485c0047c1396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\"lessThan\":\"0d5d8c3ce45c734aaf3c51cbef59155a6746157d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\"lessThan\":\"c77b30bd1dcb61f66c640ff7d2757816210c7cb0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.131\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.80\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.21\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.131\",\"matchCriteriaId\":\"2DC0D2CD-6CF8-469A-B3F5-E48375FDA274\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.80\",\"matchCriteriaId\":\"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.21\",\"matchCriteriaId\":\"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:14:22+00:00",
      "cve": "CVE-2026-31525",
      "id": "CVE-2026-31525",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31525.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.