CVE-2026-93127

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF (Berkeley Packet Filter) subsystem where the verifier incorrectly tracks register values during stack fills. When a spilled scalar is filled using a sign-extending narrowing load (BPF MEMSX), the check stack read fixed off() function copies the scalar id. If the same slot is filled with a zero-extending load (BPF MEM), both registers share the same id despite holding different values. A subsequent comparison can cause the verifier to incorrectly refine the value of the sign-extended register via sync linked regs(), leading to a discrepancy between the verifier's internal state and the actual CPU execution. This divergence can be exploited to achieve out-of-bounds memory access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.