CVE-2026-45933

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF verifier where the sync linked regs() function incorrectly copies the ID of a known register to another register when propagating bounds. Specifically, if a register is linked and then modified (e.g., using BPF ADD CONST), the sync linked regs() function may cause the target register to inherit this constant ID. This leads to a situation where subsequent calls to assign scalar id before mov() assign a new ID to the register, breaking the link between the registers. Consequently, updated bounds are not propagated, which can allow the verifier to permit unsafe operations, such as a division by zero, because it maintains an incorrect view of the register's bounds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.