CVE-2026-31413 bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
A logic error in the Linux kernel BPF verifier allows out-of-bounds map access, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31413?
CVE-2026-31413 is a high-severity memory corruption vulnerability in Linux kernel, published on 12 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1.
For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0.
The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access.
Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode.
Weakness: CWE-125
Which versions are affected by CVE-2026-31413?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31413?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31413 being exploited?
There is no known exploitation of CVE-2026-31413 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31413, DEBIAN-CVE-2026-31413, GHSA-q7pg-xjgf-wr6f, ROOT-OS-UBUNTU-2404-CVE-2026-31413, UBUNTU-CVE-2026-31413.