{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-45933", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.086Z", "datePublished": "2026-05-27T12:17:51.127Z", "dateUpdated": "2026-08-05T12:28:47.803Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:47.803Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve id of register in sync_linked_regs()\n\nsync_linked_regs() copies the id of known_reg to reg when propagating\nbounds of known_reg to reg using the off of known_reg, but when\nknown_reg was linked to reg like:\n\nknown_reg = reg ; both known_reg and reg get same id\nknown_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST\n\nnow when a call to sync_linked_regs() happens, let's say with the following:\n\nif known_reg >= 10 goto pc+2\n\nknown_reg's new bounds are propagated to reg but now reg gets\nBPF_ADD_CONST from the copy.\n\nThis means if another link to reg is created like:\n\nanother_reg = reg ; another_reg should get the id of reg but\n assign_scalar_id_before_mov() sees\n BPF_ADD_CONST on reg and assigns a new id to it.\n\nAs reg has a new id now, known_reg's link to reg is broken. If we find\nnew bounds for known_reg, they will not be propagated to reg.\n\nThis can be seen in the selftest added in the next commit:\n\n0: (85) call bpf_get_prandom_u32#7 ; R0=scalar()\n1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n4: (a5) if r1 < 0xa goto pc+4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n5: (bf) r2 = r0 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)\n6: (a5) if r1 < 0xe goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n7: (35) if r0 >= 0xa goto pc+1 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))\n8: (37) r0 /= 0\ndiv by zero\n\nWhen 4 is verified, r1's bounds are propagated to r0 but r0 also gets\nBPF_ADD_CONST (bug).\nWhen 5 is verified, r0 gets a new id (2) and its link with r1 is broken.\n\nAfter 6 we know r1 has bounds [14, 259] and therefore r0 should have\nbounds [10, 255], therefore the branch at 7 is always taken. But because\nr0's id was changed to 2, r1's new bounds are not propagated to r0.\nThe verifier still thinks r0 has bounds [6, 255] before 7 and execution\ncan reach div by zero.\n\nFix this by preserving id in sync_linked_regs() like off and subreg_def." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the BPF verifier, reached only by loading a crafted BPF program via the bpf() syscall from a local process; remote data never reaches this code.\nAC:L - The attacker writes the exact BPF instruction sequence that deterministically triggers the broken link in sync_linked_regs(); no race or uncontrolled condition is involved.\nPR:L - The verifier runs for all program loads, and socket-filter/cgroup-skb programs are loadable without CAP_BPF when unprivileged_bpf_disabled=0 (a supported default), so any unprivileged local user can reach it.\nUI:N - The attacker loads and runs their own program; no victim action is required.\nS:U - Impact is confined to the kernel's own security authority — standard local privilege escalation, no crossing into a separate VM/IOMMU boundary.\nC:H - The verifier can be made to believe a register holds a wrong value, allowing a verified-as-safe out-of-bounds read primitive over kernel memory, yielding arbitrary kernel memory disclosure.\nI:H - The same false-bounds primitive enables an out-of-bounds write the verifier \"proved\" safe, giving an arbitrary kernel write usable for privilege escalation and code-flow hijacking.\nA:H - The resulting out-of-bounds accesses on attacker-controlled values readily corrupt kernel memory and panic/crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/verifier.c" ], "versions": [ { "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "58059335e46537de682db84984f7716c813208c4", "status": "affected", "versionType": "git" }, { "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "92a8cb1806adefb263cf096eab6705705cf7eee1", "status": "affected", "versionType": "git" }, { "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "65d114b5270b62aefb820ecd6c3b7caeea8f895d", "status": "affected", "versionType": "git" }, { "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2", "lessThan": "af9e89d8dd39530c8bd14c33ddf6b502df1071b6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/verifier.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/58059335e46537de682db84984f7716c813208c4" }, { "url": "https://git.kernel.org/stable/c/92a8cb1806adefb263cf096eab6705705cf7eee1" }, { "url": "https://git.kernel.org/stable/c/65d114b5270b62aefb820ecd6c3b7caeea8f895d" }, { "url": "https://git.kernel.org/stable/c/af9e89d8dd39530c8bd14c33ddf6b502df1071b6" } ], "title": "bpf: Preserve id of register in sync_linked_regs()", "x_generator": { "engine": "bippy-1.2.0" } } } }