The Linux kernel's BPF interpreter had undefined behavior in its signed 32-bit division (sdiv) and modulo (smod) handlers when processing the minimum signed 32-bit integer (S32_MIN, 0x80000000). The kernel's abs() macro, used on s32 operands, is documented to have undefined results for this input. On arm64 and x86 architectures, abs((s32)DST) returned S32_MIN unchanged, which was then sign-extended incorrectly, causing do_div() to compute incorrect results. This discrepancy between the verifier's mathematically correct range tracking and the interpreter's behavior created a verifier/interpreter mismatch exploitable for out-of-bounds map value access. The fix introduced a new abs_s32() function that correctly handles S32_MIN by casting to u32 before negation, avoiding signed overflow. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related builds. The patch is available and included in official Linux kernel updates.

Successful exploitation of this vulnerability could allow an attacker with local privileges to cause out-of-bounds access in BPF map values, potentially leading to privilege escalation or system compromise. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported at this time.

A patch is available and included in Linux kernel versions 6.8.0-1064.72 and later, as well as related builds. Users should update their Linux kernel to a fixed version as soon as possible and reboot the system to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating and rebuilding kernel modules. No additional mitigations are specified beyond applying the official patch.