Linux kernel BPF verifier: sync_linked_regs() overwrites a register id, breaking bounds propagation

Impact

sync_linked_regs() copied the id of the known register onto the target register, which also carried over the BPF_ADD_CONST marker. A later copy of that register then got a fresh id, silently breaking the link, so refined bounds learned for one register stopped propagating to the other. The upstream commit shows the verifier concluding a register can hold [6,255] when the real range is [10,255], letting execution reach a division by zero that should have been proved unreachable - that is the verifier accepting a program whose value ranges it has gotten wrong, which generalises to out-of-bounds access, not just a divide fault. This is distinct from the indirect-jump liveness bug in the same subsystem: different mechanism, different fix, different commits. On a GPU node the risk is whatever holds BPF load rights - observability agents, CNI, service mesh - becoming a route to kernel compromise.

Who can reach it

Local, requires privileges to load a BPF program (CAP_BPF/CAP_SYS_ADMIN, or unprivileged BPF left enabled). The flaw is in verification, so the attacker must be able to submit a crafted program; no network or GPU access needed.

What to do

Update to a stable kernel carrying the id-preservation fix (four stable branches in the record) and reboot each node. Until then, disable unprivileged BPF (kernel.unprivileged_bpf_disabled=1) and keep CAP_BPF/CAP_SYS_ADMIN out of tenant pod specs, which leaves only your own trusted agents able to reach the verifier.

References

Related entries

• Linux kernel AMD CCP driver: kfree on a stack address crashes the kernelCVE-2026-45959 · Linux kernel crypto/ccp (AMD Secure Processor driver, __cleanup/kfree misuse)High
• Linux kernel (drivers/vfio/cdx): VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configurationCVE-2026-46036 · Linux kernel (drivers/vfio/cdx)High
• Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using fieldCVE-2026-46116 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/net/ethernet/mellanox/mlx4): Shared receive queue objects are looked up from an asynchronousCVE-2026-46181 · Linux kernel (drivers/net/ethernet/mellanox/mlx4)High
• Linux kernel vmw_pvrdma: double free on ucontext allocation error pathCVE-2026-46189 · Linux kernel vmw_pvrdma driver (pvrdma_alloc_ucontext error path)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-46197 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High