bpf: Fix stack slot index in nospec checks

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].

Timeline

1. Aug 15, 2026, 5:56 AM UTCCVE published
2. Aug 17, 2026, 5:14 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 5.10.56 · fixed in 5.10.261; From 4.19.207 · fixed in 4.20; From 5.4.146 · fixed in 5.5; From 5.13.8 · fixed in 5.14

• Linux Linux

  5.14

References 8