Linux Kernel EUVD-2026-59069

The vulnerability resides in the Linux kernel's BPF verifier, specifically in check_mem_access() within the BPF subsystem's static analysis engine. The BPF verifier performs abstract interpretation of BPF programs before execution to guarantee memory safety. When verifying a load of an LSM (Linux Security Module) hook return value, the is_retval code path calls __mark_reg_s32_range() to constrain the destination register to the hook's valid return range. The defect is that __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than resetting them first via mark_reg_unknown(). If a preceding instruction (e.g., BPF_MOV64_IMM) has set stale bounds on the destination register, the intersection produces an artificially narrow range that the verifier treats as definitive. At runtime, the actual LSM hook return value is loaded into the register, producing a value outside the range the verifier certified as safe. This verifier/runtime mismatch invalidates the verifier's safety proofs for affected programs, enabling out-of-bounds memory operations the verifier erroneously approved. The else branch of the same conditional already correctly calls mark_reg_unknown() - the is_retval path was simply missing the equivalent reset.