Linux kernel BPF verifier: inconsistent ADD_CONST base ids let unsafe state pruning succeed

Impact

When regsafe() compared two scalar registers carrying BPF_ADD_CONST, check_scalar_ids() mapped the compound id but never verified that the stripped base ids agreed with existing mappings. An attacker can construct two verifier states - old with R3 = R2 + 10, current with R3 = R4 + 10 from an unrelated base - and the idmap records two independent entries without noticing the conflict, so state pruning wrongly succeeds. That means the verifier accepts a program whose register relationships it has not actually proven, which is the standard route to out-of-bounds kernel reads and writes from a BPF program. Verifier soundness bugs deserve more attention than a generic local 7.8 suggests: the verifier is the only thing standing between a loaded program and arbitrary kernel memory, and on nodes where BPF loading is delegated to agents or tenants it is a trust boundary, not an implementation detail.

Who can reach it

Local. Requires the ability to load a crafted BPF program - CAP_BPF or CAP_SYS_ADMIN, or unprivileged BPF where it is still enabled. The exploit is the program itself; no race and no special hardware.

What to do

Patch to a fixed stable or distribution kernel and reboot; the fix adds a check_ids() call on the stripped base ids. Red Hat tracks it for RHEL 6 through 10. In the interim, confirm unprivileged BPF is off (kernel.unprivileged_bpf_disabled=1) and that CAP_BPF is held only by agents you control - that closes the realistic path for most clusters without a reboot.

References

Related entries

• Linux kernel BPF task_vma iterator: mm_struct used without a reference, freed under the iteratorCVE-2026-53085 · Linux kernel BPF (open-coded task_vma iterator, mm_struct lifecycle)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High
• Linux kernel BPF offload: dev-bound program freed while offload->prog still points at itCVE-2026-53094 · Linux kernel BPF offload (stale offload->prog after bpf_jit_blind_constants)High
• Linux bpf devmap: non-RCU hash iteration in the XDP broadcast redirect path can read a half-built entryCVE-2026-53096 · Linux kernel bpf devmap (dev_map_redirect_multi, DEVMAP_HASH SKB path)High