Linux Kernel EUVD-2026-27373

This vulnerability resides in the Linux kernel's eBPF (extended Berkeley Packet Filter) verifier, which performs static analysis on BPF programs before allowing them to run in kernel space. The verifier tracks scalar register values and their relationships through unique IDs-when registers share an ID (via register copy operations like r1=r0), the verifier assumes they contain identical values and propagates learned bounds between them. The BPF_END instruction performs byte-order swapping (endianness conversion) and mutates the register value in-place, but unlike similar instructions (BPF_NEG), it fails to call __mark_reg_known or explicitly reset dst_reg->id to zero. This means the register retains its shared ID after its value has fundamentally changed. When subsequent conditional jumps establish bounds on the swapped register, the verifier incorrectly applies those bounds to any register still sharing the old ID, creating a state where the verifier believes a register is safely bounded when it actually contains an unrelated value. This verification-time versus runtime mismatch enables classical confused deputy attacks where verified-safe programs perform unsafe operations. The affected code paths are in the BPF register tracking logic, specifically the scalar ID management during instruction processing.