CVE-2026-31413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31413", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.087Z", "datePublished": "2026-04-12T05:36:14.632Z", "dateUpdated": "2026-08-05T12:22:19.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:19.762Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n\nmaybe_fork_scalars() is called for both BPF_AND and BPF_OR when the\nsource operand is a constant. When dst has signed range [-1, 0], it\nforks the verifier state: the pushed path gets dst = 0, the current\npath gets dst = -1.\n\nFor BPF_AND this is correct: 0 & K == 0.\nFor BPF_OR this is wrong: 0 | K == K, not 0.\n\nThe pushed path therefore tracks dst as 0 when the runtime value is K,\nproducing an exploitable verifier/runtime divergence that allows\nout-of-bounds map access.\n\nFix this by passing env->insn_idx (instead of env->insn_idx + 1) to\npush_stack(), so the pushed path re-executes the ALU instruction with\ndst = 0 and naturally computes the correct result for any opcode."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable verifier path is reached through the local bpf() syscall during BPF_PROG_LOAD, not through a remote protocol. A plausible path is an attacker-supplied socket-filter BPF program using attacker-created maps.\nAC:L - The attacker controls the BPF bytecode, map layout, and scalar values needed to trigger the verifier/runtime divergence. There is no race or external condition beyond attacker control.\nPR:L - Exploitation requires a local user able to load BPF programs, which can be a basic unprivileged user where unprivileged BPF is enabled or a delegated BPF capability path exists. It does not inherently require real init-namespace root for the vulnerable verifier logic.\nUI:N - No victim action is required after the attacker loads and runs the crafted BPF program. The trigger is fully under the local attacker's control.\nS:U - This is a standard kernel privilege-escalation style BPF verifier flaw within the same host kernel security authority. It does not cross a VM, hypervisor, or IOMMU boundary.\nC:H - The verifier/runtime divergence allows out-of-bounds map-value reads, which can expose adjacent kernel heap data and be developed into broader kernel memory disclosure. BPF verifier OOB map-access bugs are commonly exploitable as kernel read primitives.\nI:H - The same incorrect bounds reasoning can be applied to writes through map-value pointers, enabling out-of-bounds kernel heap corruption. That is sufficient for arbitrary kernel memory modification or code execution in a defensible worst case.\nA:H - Out-of-bounds BPF memory access can corrupt kernel memory or fault the kernel, causing an oops, panic, or hang. Even failed exploitation can be repeatedly triggered by the local attacker."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "dea9989a3f3961faede93752cd81eb5a9514d911", "lessThan": "342aa1ee995ef5bbf876096dc3a5e51218d76fa4", "status": "affected", "versionType": "git"}, {"version": "4c122e8ae14950cf6b59d208fc5160f7c601e746", "lessThan": "58bd87d0e69204dbd739e4387a1edb0c4b1644e7", "status": "affected", "versionType": "git"}, {"version": "e52567173ba86dbffb990595fbe60e2e83899372", "lessThan": "d13281ae7ea8902b21d99d10a2c8caf0bdec0455", "status": "affected", "versionType": "git"}, {"version": "bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7", "lessThan": "c845894ebd6fb43226b3118d6b017942550910c5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "6.12.75", "lessThan": "6.12.80", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.21", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4"}, {"url": "https://git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7"}, {"url": "https://git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455"}, {"url": "https://git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5"}], "title": "bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "342aa1ee995ef5bbf876096dc3a5e51218d76fa4", "status": "affected", "version": "dea9989a3f3961faede93752cd81eb5a9514d911", "versionType": "git"}, {"lessThan": "58bd87d0e69204dbd739e4387a1edb0c4b1644e7", "status": "affected", "version": "4c122e8ae14950cf6b59d208fc5160f7c601e746", "versionType": "git"}, {"lessThan": "d13281ae7ea8902b21d99d10a2c8caf0bdec0455", "status": "affected", "version": "e52567173ba86dbffb990595fbe60e2e83899372", "versionType": "git"}, {"lessThan": "c845894ebd6fb43226b3118d6b017942550910c5", "status": "affected", "version": "bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.12.80", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.21", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "6.19.11", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C57E63A-04BA-47E0-A942-789F7236A636", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n\nmaybe_fork_scalars() is called for both BPF_AND and BPF_OR when the\nsource operand is a constant. When dst has signed range [-1, 0], it\nforks the verifier state: the pushed path gets dst = 0, the current\npath gets dst = -1.\n\nFor BPF_AND this is correct: 0 & K == 0.\nFor BPF_OR this is wrong: 0 | K == K, not 0.\n\nThe pushed path therefore tracks dst as 0 when the runtime value is K,\nproducing an exploitable verifier/runtime divergence that allows\nout-of-bounds map access.\n\nFix this by passing env->insn_idx (instead of env->insn_idx + 1) to\npush_stack(), so the pushed path re-executes the ALU instruction with\ndst = 0 and naturally computes the correct result for any opcode."}], "id": "CVE-2026-31413", "lastModified": "2026-06-17T10:33:40.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-12T06:16:20.050", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/342aa1ee995ef5bbf876096dc3a5e51218d76fa4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58bd87d0e69204dbd739e4387a1edb0c4b1644e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c845894ebd6fb43226b3118d6b017942550910c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d13281ae7ea8902b21d99d10a2c8caf0bdec0455"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR", "id": "2457626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457626"}, "csaw": false, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. This vulnerability arises from an incorrect handling of certain operations within the BPF verifier, which is responsible for ensuring the safety of BPF programs. This discrepancy between the verifier's analysis and the program's actual execution can be exploited by a local attacker. Successful exploitation could lead to out-of-bounds memory access, potentially allowing for privilege escalation or information disclosure."], "name": "CVE-2026-31413", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31413\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31413\nhttps://lore.kernel.org/linux-cve-announce/2026041220-CVE-2026-31413-cce6@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dea9989a3f3961faede93752cd81eb5a9514d911,342aa1ee995ef5bbf876096dc3a5e51218d76fa4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c122e8ae14950cf6b59d208fc5160f7c601e746,58bd87d0e69204dbd739e4387a1edb0c4b1644e7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e52567173ba86dbffb990595fbe60e2e83899372,d13281ae7ea8902b21d99d10a2c8caf0bdec0455)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7,c845894ebd6fb43226b3118d6b017942550910c5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0-rc1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0-rc1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-13T12:41:33.351669+00:00", "updated": "2026-05-20T18:15:26.572572+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}