Linux kernel BPF verifier: register used by an indirect jump is not marked live

Impact

For a gotox rX indirect-jump instruction the verifier failed to mark rX as used in compute_insn_live_regs(). Liveness information feeds the verifier's state pruning, so a register the program actually reads can be treated as dead - the class of mistake that lets a program carry unverified state past a pruning point. The record is a one-line fix with no published exploit, so treat this as a verifier soundness bug rather than a demonstrated escalation. It matters on GPU nodes because observability and CNI agents commonly hold BPF load privileges, and the kernel BPF verifier is the only thing standing between a loadable program and ring 0. Indirect jumps (gotox) are a recent addition, so only kernels new enough to support them are affected - the record lists 7.0 and two stable commits, a much narrower blast radius than the typical kernel CVE.

Who can reach it

Local, requires the ability to load a BPF program - CAP_BPF/CAP_SYS_ADMIN, or an unprivileged-BPF-enabled host. That usually means a privileged daemon or a pod running with those capabilities, not an ordinary tenant workload.

What to do

Take the stable kernel update with the liveness fix and reboot the node. Only kernels with BPF indirect-jump support are affected, so confirm your version before scheduling anything. In the meantime, keeping kernel.unprivileged_bpf_disabled=1 and not granting CAP_BPF to tenant pods removes the load path for everything except your own agents.

References

Related entries

• Linux kernel io_uring: legacy buffer recycle does not re-check that the buffer list still exists or is legacyCVE-2026-43366 · Linux kernel io_uring provided buffers (kbuf legacy recycle path)High
• Linux kernel (net/rds): When pinning user pages for a zerocopy RDS send fails, the pages are released but theCVE-2026-43494 · Linux kernel (net/rds)High
• Linux kernel (net/rds): A zerocopy RDS send that fails after pinning user pages but before the message reaches theCVE-2026-43502 · Linux kernel (net/rds)High
• Linux kernel BPF: negative CO-RE accessor index causes an out-of-bounds read and deterministic kernel crashCVE-2026-45839 · Linux kernel BPF verifier (bpf_core_parse_spec CO-RE accessor parsing)High
• Linux kernel (drivers/iommu/intel): VT-d publishes the address of a freshly allocated PASID table into the PASIDCVE-2026-45862 · Linux kernel (drivers/iommu/intel)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-45878 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High