GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31413 (GCVE-0-2026-31413)

Vulnerability from cvelistv5 – Published: 2026-04-12 05:36 – Updated: 2026-08-05 12:22
VLAI
Title
bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1. For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0. The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access. Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dea9989a3f3961faede93752cd81eb5a9514d911 , < 342aa1ee995ef5bbf876096dc3a5e51218d76fa4 (git)
Affected: 4c122e8ae14950cf6b59d208fc5160f7c601e746 , < 58bd87d0e69204dbd739e4387a1edb0c4b1644e7 (git)
Affected: e52567173ba86dbffb990595fbe60e2e83899372 , < d13281ae7ea8902b21d99d10a2c8caf0bdec0455 (git)
Affected: bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 , < c845894ebd6fb43226b3118d6b017942550910c5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12.75 , < 6.12.80 (semver)
Affected: 6.18.16 , < 6.18.21 (semver)
Affected: 6.19.6 , < 6.19.11 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "342aa1ee995ef5bbf876096dc3a5e51218d76fa4",
              "status": "affected",
              "version": "dea9989a3f3961faede93752cd81eb5a9514d911",
              "versionType": "git"
            },
            {
              "lessThan": "58bd87d0e69204dbd739e4387a1edb0c4b1644e7",
              "status": "affected",
              "version": "4c122e8ae14950cf6b59d208fc5160f7c601e746",
              "versionType": "git"
            },
            {
              "lessThan": "d13281ae7ea8902b21d99d10a2c8caf0bdec0455",
              "status": "affected",
              "version": "e52567173ba86dbffb990595fbe60e2e83899372",
              "versionType": "git"
            },
            {
              "lessThan": "c845894ebd6fb43226b3118d6b017942550910c5",
              "status": "affected",
              "version": "bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.80",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.21",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.19.11",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n\nmaybe_fork_scalars() is called for both BPF_AND and BPF_OR when the\nsource operand is a constant.  When dst has signed range [-1, 0], it\nforks the verifier state: the pushed path gets dst = 0, the current\npath gets dst = -1.\n\nFor BPF_AND this is correct: 0 \u0026 K == 0.\nFor BPF_OR this is wrong:    0 | K == K, not 0.\n\nThe pushed path therefore tracks dst as 0 when the runtime value is K,\nproducing an exploitable verifier/runtime divergence that allows\nout-of-bounds map access.\n\nFix this by passing env-\u003einsn_idx (instead of env-\u003einsn_idx + 1) to\npush_stack(), so the pushed path re-executes the ALU instruction with\ndst = 0 and naturally computes the correct result for any opcode."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable verifier path is reached through the local bpf() syscall during BPF_PROG_LOAD, not through a remote protocol. A plausible path is an attacker-supplied socket-filter BPF program using attacker-created maps.\nAC:L - The attacker controls the BPF bytecode, map layout, and scalar values needed to trigger the verifier/runtime divergence. There is no race or external condition beyond attacker control.\nPR:L - Exploitation requires a local user able to load BPF programs, which can be a basic unprivileged user where unprivileged BPF is enabled or a delegated BPF capability path exists. It does not inherently require real init-namespace root for the vulnerable verifier logic.\nUI:N - No victim action is required after the attacker loads and runs the crafted BPF program. The trigger is fully under the local attacker\u0027s control.\nS:U - This is a standard kernel privilege-escalation style BPF verifier flaw within the same host kernel security authority. It does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - The verifier/runtime divergence allows out-of-bounds map-value reads, which can expose adjacent kernel heap data and be developed into broader kernel memory disclosure. BPF verifier OOB map-access bugs are commonly exploitable as kernel read primitives.\nI:H - The same incorrect bounds reasoning can be applied to writes through map-value pointers, enabling out-of-bounds kernel heap corruption. That is sufficient for arbitrary kernel memory modification or code execution in a defensible worst case.\nA:H - Out-of-bounds BPF memory access can corrupt kernel memory or fault the kernel, causing an oops, panic, or hang. Even failed exploitation can be repeatedly triggered by the local attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:19.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455"
        },
        {
          "url": "https://git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5"
        }
      ],
      "title": "bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31413",
    "datePublished": "2026-04-12T05:36:14.632Z",
    "dateReserved": "2026-03-09T15:48:24.087Z",
    "dateUpdated": "2026-08-05T12:22:19.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31413",
      "date": "2026-09-18",
      "epss": "0.00221",
      "percentile": "0.12972"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "342aa1ee995ef5bbf876096dc3a5e51218d76fa4",
                    "status": "affected",
                    "version": "dea9989a3f3961faede93752cd81eb5a9514d911",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58bd87d0e69204dbd739e4387a1edb0c4b1644e7",
                    "status": "affected",
                    "version": "4c122e8ae14950cf6b59d208fc5160f7c601e746",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d13281ae7ea8902b21d99d10a2c8caf0bdec0455",
                    "status": "affected",
                    "version": "e52567173ba86dbffb990595fbe60e2e83899372",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c845894ebd6fb43226b3118d6b017942550910c5",
                    "status": "affected",
                    "version": "bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.12.80",
                    "status": "affected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.21",
                    "status": "affected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.19.11",
                    "status": "affected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086",
                    "versionEndExcluding": "6.12.80",
                    "versionStartIncluding": "6.12.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6C57E63A-04BA-47E0-A942-789F7236A636",
                    "versionEndExcluding": "6.18.21",
                    "versionStartIncluding": "6.18.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9",
                    "versionEndExcluding": "6.19.11",
                    "versionStartIncluding": "6.19.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n\nmaybe_fork_scalars() is called for both BPF_AND and BPF_OR when the\nsource operand is a constant.  When dst has signed range [-1, 0], it\nforks the verifier state: the pushed path gets dst = 0, the current\npath gets dst = -1.\n\nFor BPF_AND this is correct: 0 \u0026 K == 0.\nFor BPF_OR this is wrong:    0 | K == K, not 0.\n\nThe pushed path therefore tracks dst as 0 when the runtime value is K,\nproducing an exploitable verifier/runtime divergence that allows\nout-of-bounds map access.\n\nFix this by passing env-\u003einsn_idx (instead of env-\u003einsn_idx + 1) to\npush_stack(), so the pushed path re-executes the ALU instruction with\ndst = 0 and naturally computes the correct result for any opcode."
          }
        ],
        "id": "CVE-2026-31413",
        "lastModified": "2026-06-17T10:33:40.053",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-12T06:16:20.050",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:25:13+00:00",
      "cve": "CVE-2026-31413",
      "id": "CVE-2026-31413",
      "initial_release_date": "2026-04-12T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31413.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:25:21Z",
      "cve": "CVE-2026-31413",
      "id": "CVE-2026-31413",
      "initial_release_date": "2026-04-12T23:24:41Z",
      "product_status:known_not_affected": "305",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31413",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31413.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.