CVE-2026-31525

HIGH EPSS 2.9%
Published Apr 22, 20262mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Apr 22, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result. The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access. Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers. s32 is the only affected case -- the s64 division/modulo handlers do not use abs().

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
2.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 8

VendorProductVersionRange
linuxlinux_kernel*≥6.6  –  <6.6.131
linuxlinux_kernel*≥6.7  –  <6.12.80
linuxlinux_kernel*≥6.13  –  <6.18.21
linuxlinux_kernel*≥6.19  –  <6.19.11
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 5

  • git.kernel.org https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396
    Patch