Linux Kernel BPF Bug Forks Verifier, Allows OOB Map Access

A critical vulnerability, tracked as CVE-2026-31413, has been identified and patched in the Linux kernel. According to CVE Notify, the issue lies within the BPF verifier’s maybe_fork_scalars() function, specifically when handling the BPF_OR instruction with a constant source operand.

The core problem stems from an unsound scalar forking mechanism. When the destination register (dst) has a signed range of [-1, 0], the verifier incorrectly forks its state. For BPF_AND operations, this logic is sound: 0 & K correctly evaluates to 0. However, for BPF_OR, this logic breaks down. If the pushed path tracks dst as 0 while the runtime value is actually K (where 0 | K == K), it creates a divergence between what the verifier expects and what the runtime actually executes. This discrepancy can be exploited, leading to out-of-bounds map access, a classic primitive for privilege escalation or information disclosure.

The fix, as detailed in the kernel’s stable tree, involves passing env->insn_idx instead of env->insn_idx + 1 to push_stack(). This ensures that the pushed path re-executes the ALU instruction with dst = 0, allowing it to correctly compute the result for any opcode and thus eliminating the verifier/runtime divergence.