CVE-2026-31525
Integer Overflow in Linux Kernel BPF Interpreter Causes Out-of-Bounds Access
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 6.6 (inc) to 6.6.131 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's BPF interpreter, specifically in the signed 32-bit division and modulo handlers. The issue arises because these handlers use the kernel's abs() macro on signed 32-bit integers (s32), which leads to undefined behavior when the input is the minimum possible 32-bit integer value (S32_MIN). On certain architectures like arm64 and x86, this causes the abs() macro to return the minimum value unchanged, which then leads to incorrect calculations in the division operation. This mismatch between the interpreter and the verifier can be exploited to access out-of-bounds map values.
How can this vulnerability impact me? :
The vulnerability can be exploited to cause out-of-bounds access to map values in the Linux kernel's BPF subsystem. This could potentially allow an attacker to read or write memory outside of intended boundaries, leading to unpredictable behavior, possible privilege escalation, or system instability.