In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext_dst based on static register liveness analysis As reported in… (CVE-2026-98869)

The Linux kernel BPF verifier's logic for zero extension of 32-bit operations on s390 architecture was broken due to removal of certain liveness tracking steps. This could allow the upper half of a 64-bit register to contain arbitrary values if the verifier failed to mark instructions requiring zero extension. The fix reintroduces static register liveness analysis to infer zero extension requirements, ensuring correct semantics for 32-bit operations. The patch replaces subreg_def based logic with a static analysis in bpf_compute_live_registers(), tracking upper and lower halves separately and marking instructions accordingly. A minor precision drop occurs with BPF subprogram calls, assuming all 64 bits of parameter registers are used, but this is not expected to impact performance significantly.

The vulnerability could cause incorrect zero extension of 32-bit operations on s390 architecture, potentially leading to arbitrary values in the upper half of registers during BPF program verification. This could affect the correctness and security of BPF programs relying on these semantics. No active exploits are known, and the impact is limited to the s390 architecture's BPF verifier.

A fix has been implemented in the Linux kernel that replaces the dynamic tracking of register liveness with a static analysis approach to correctly infer zero extension requirements. Users should update to the Linux kernel version that includes this fix. Since no specific affected versions or patch links are provided, check the official Linux kernel advisories or source repositories for the commit identified as 107e16979905 and related patches for remediation.