Vulnerability-Lookup

GHSA-6CRF-588F-8R2F

Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-18 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop scalar id on sign-extending narrowing stack fills

When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later 'if == const' then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access.

Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-93127"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:18:07Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop scalar id on sign-extending narrowing stack fills\n\nWhen a spilled scalar is filled back with a sign-extending narrowing load\n(BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register\nincluding its scalar id, but coerce_reg_to_size_sx() then sign-extends the\nfilled register\u0027s value. If the same slot is also filled with a plain\nzero-extending load (BPF_MEM), both destination registers share the id yet\nhold different values. A later \u0027if \u003czext-reg\u003e == const\u0027 then refines the\nsign-extended register through sync_linked_regs() to a value it does not\nhave at runtime (e.g. the verifier believes 0x80000000 while the register\nis 0xffffffff80000000), which can be turned into an out-of-bounds access.\n\nDrop the shared scalar id at the sign-extension site in check_mem_access()\nwhen sign extension actually changes the value, mirroring the BPF_MOVSX\nhandling in check_alu_op() (no_sext = reg_umax \u003c 2^(size*8-1)).",
  "id": "GHSA-6crf-588f-8r2f",
  "modified": "2026-09-18T18:31:34Z",
  "published": "2026-09-17T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93127"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2cb5f4ca695ebe552647e5ba4aad6934d6a43bae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f3614622dc41f3dd99bb4f691da253814e4e6cae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-93127 (GCVE-0-2026-93127)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-10-19 09:06

Title

bpf: Drop scalar id on sign-extending narrowing stack fills

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later 'if <zext-reg> == const' then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access. Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/f3614622dc41f3dd9…
https://git.kernel.org/stable/c/2cb5f4ca695ebe552…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3cd5c890652ba1f0682adc291b5446245259b692 , < f3614622dc41f3dd99bb4f691da253814e4e6cae (git) Affected: 3cd5c890652ba1f0682adc291b5446245259b692 , < 2cb5f4ca695ebe552647e5ba4aad6934d6a43bae (git)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3614622dc41f3dd99bb4f691da253814e4e6cae",
              "status": "affected",
              "version": "3cd5c890652ba1f0682adc291b5446245259b692",
              "versionType": "git"
            },
            {
              "lessThan": "2cb5f4ca695ebe552647e5ba4aad6934d6a43bae",
              "status": "affected",
              "version": "3cd5c890652ba1f0682adc291b5446245259b692",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop scalar id on sign-extending narrowing stack fills\n\nWhen a spilled scalar is filled back with a sign-extending narrowing load\n(BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register\nincluding its scalar id, but coerce_reg_to_size_sx() then sign-extends the\nfilled register\u0027s value. If the same slot is also filled with a plain\nzero-extending load (BPF_MEM), both destination registers share the id yet\nhold different values. A later \u0027if \u003czext-reg\u003e == const\u0027 then refines the\nsign-extended register through sync_linked_regs() to a value it does not\nhave at runtime (e.g. the verifier believes 0x80000000 while the register\nis 0xffffffff80000000), which can be turned into an out-of-bounds access.\n\nDrop the shared scalar id at the sign-extension site in check_mem_access()\nwhen sign extension actually changes the value, mirroring the BPF_MOVSX\nhandling in check_alu_op() (no_sext = reg_umax \u003c 2^(size*8-1))."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled input is BPF bytecode supplied via bpf(BPF_PROG_LOAD) in SYSCALL_DEFINE5(bpf) \u2192 bpf_prog_load() \u2192 bpf_check() \u2192 do_check_insn(); the bug fires on local BPF_LDX BPF_MEMSX/BPF_MEM stack fills in check_mem_access(), not on a remote protocol message.\nAC:L - The attacker writes the instruction sequence; ldsx_fill_scalar_id_not_shared deterministically spills a u32 with bit 31 set, fills it with *(s32*) into r4 and *(u32*) into r5, then uses if r5 == 0x80000000 so sync_linked_regs() poisons r4, with no race or external state.\nPR:L - check_stack_write_fixed_off()/check_stack_read_fixed_off() only preserve spilled scalar ids when env-\u003ebpf_capable, set from bpf_token_capable(CAP_BPF) in bpf_check(); unprivileged socket-filter loads therefore miss this path. CAP_BPF is delegable into a user namespace via bpf_token_create(), so this is Low, not init-namespace root.\nUI:N - The attacker loads the crafted program with bpf(BPF_PROG_LOAD), creates the hash map, and triggers bpf_map_lookup_elem plus the MEMSX/MEM fills themselves; no other user must mount media, open a file, or otherwise act.\nS:U - The confused r4 offset is applied to a PTR_TO_MAP_VALUE from bpf_map_lookup_elem() and corrupts host kernel heap in the same security authority; this is a verifier-bypass local privilege escalation, not a KVM/IOMMU guest-to-host crossing.\nC:H - After sync_linked_regs() copies known 0x80000000 onto the sign-extended r4 (runtime 0xffffffff80000000), r4 \u003e\u003e= 63 is believed 0 but is 1, so r0 += r4; *(u8*)(r0+7) on the 8-byte map value is an accepted out-of-bounds kernel read; repeating r0 += r4 yields an arbitrary-length read primitive.\nI:H - The same false r4==0 bound lets the verifier accept a store through that map-value pointer (replace the *(u8*)(r0+7) load with a store); repeating r0 += r4 before the store is an arbitrary kernel heap write usable for control-flow hijacking.\nA:H - The accepted program performs an out-of-bounds access on the bpf_map_lookup_elem() result (the selftest is rejected after the fix with \"R0 max value is outside of the allowed memory range\"); that heap OOB can oops or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:06:00.545Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3614622dc41f3dd99bb4f691da253814e4e6cae"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cb5f4ca695ebe552647e5ba4aad6934d6a43bae"
        }
      ],
      "title": "bpf: Drop scalar id on sign-extending narrowing stack fills",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93127",
    "datePublished": "2026-09-17T16:11:31.253Z",
    "dateReserved": "2026-09-17T16:02:15.087Z",
    "dateUpdated": "2026-10-19T09:06:00.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted