Executive brief
The Linux kernel's eBPF verifier contains a flaw in how it tracks variable identities during sign-extending memory loads. When the same memory location is read with both zero-extending and sign-extending operations, the verifier incorrectly assumes they hold the same value, allowing an attacker to trigger out-of-bounds memory access through a malicious eBPF program. This can lead to information disclosure or privilege escalation on systems that allow unprivileged eBPF program loading.
Technical details
The vulnerability exists in the BPF verifier's check_mem_access() function when handling sign-extending narrowing loads (BPF_MEMSX). When a spilled scalar is filled back with a sign-extending load, the verifier copies the register including its scalar id. However, if the same stack slot is subsequently filled with a zero-extending load (BPF_MEM), both destination registers share the same id despite holding different values. A conditional check on the zero-extended register can then refine the sign-extended register through sync_linked_regs() to a value it does not actually hold at runtime, enabling out-of-bounds access. The fix drops the shared scalar id when sign-extension changes the register value, mirroring the existing BPF_MOVSX handling. Attack requires unprivileged eBPF program loading capability.
Affected products
- Linux Linux Kernel multiple versions affected; fix in commit 2cb5f4ca695ebe552647e5ba4aad6934d6a43bae
Timeline
- 2026-09-17: disclosed: CVE-2026-93127 published
- 2026-07-09: patched: Fix committed as 2cb5f4ca695ebe552647e5ba4aad6934d6a43bae