eBPF verifier bug report flags incomplete register reset on errors

A logic flaw in the Linux kernel's eBPF verifier error-recovery path may let crafted programs slip past safety checks, according to a report posted to the BPF development list and kernel security contacts.

Researcher Daksh Vohra said that when the verifier catches a register bounds invariant violation, it resets that register's min and max ranges so checking can continue, yet leaves the register's scalar identity and delta links to other registers uncleared. Later sync of linked registers can then copy the wiped or inconsistent bounds onto a still-trusted register, producing a state mismatch that Vohra argued could enable out-of-bounds memory access in the kernel.

Greg Kroah-Hartman replied that the report was already on the public BPF list and should proceed as an ordinary patch for normal review. BPF maintainer Daniel Borkmann asked for a concrete standalone reproducer against the latest BPF tree, noting the project has already fixed several similar scalar-id clearing problems.

No CVE appears in the public exchange, and no fix has landed pending a clearer demonstration.