CVE-2026-53081

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars<br /> <br /> When regsafe() compares two scalar registers that both carry<br /> BPF_ADD_CONST, check_scalar_ids() maps their full compound id<br /> (aka base | BPF_ADD_CONST flag) as one idmap entry. However,<br /> it never verifies that the underlying base ids, that is, with<br /> the flag stripped are consistent with existing idmap mappings.<br /> <br /> This allows construction of two verifier states where the old<br /> state has R3 = R2 + 10 (both sharing base id A) while the current<br /> state has R3 = R4 + 10 (base id C, unrelated to R2). The idmap<br /> creates two independent entries: A-&gt;B (for R2) and A|flag-&gt;C|flag<br /> (for R3), without catching that A-&gt;C conflicts with A-&gt;B. State<br /> pruning then incorrectly succeeds.<br /> <br /> Fix this by additionally verifying base ID mapping consistency<br /> whenever BPF_ADD_CONST is set: after mapping the compound ids,<br /> also invoke check_ids() on the base IDs (flag bits stripped).<br /> This ensures that if A was already mapped to B from comparing<br /> the source register, any ADD_CONST derivative must also derive<br /> from B, not an unrelated C.