CVE-2026-31413
MediumSummary
A vulnerability in the Linux kernel related to unsound scalar forking in maybe_fork_scalars() for BPF_OR has been fixed. The issue occurred when the source operand was a constant and the dst range was signed in the range [-1, 0].
Risk Assessment
This vulnerability could lead to an incorrect verifier state, potentially resulting in unpredictable system behavior. It may affect the security of applications using BPF.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability. Additionally, monitor systems for unauthorized changes.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: