Linux Kernel BPF Verifier Unsound Scalar Forking in maybe_fork_scalars() for BPF_OR Leading to OOB Map Access

#!/usr/bin/env bash
# check_cve_2026_31413.sh — Detect CVE-2026-31413 (BPF verifier scalar forking bug)
# Affected: 6.12.75-6.12.79, 6.18.16-6.18.20, 6.19.6-6.19.10, 7.0-rc1 through 7.0-rc4
# Fixed:    6.12.80, 6.18.21, 6.19.11, 7.0-rc5+
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch; strip suffixes like -generic, -cloud, -aws
BASE=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$BASE" ]]; then
  echo "[?] UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$BASE" | cut -d. -f1)
MINOR=$(echo "$BASE" | cut -d. -f2)
PATCH=$(echo "$BASE" | cut -d. -f3)

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# Check for 7.0-rcN pattern
if [[ $MAJOR -eq 7 && $MINOR -eq 0 ]]; then
  RC=$(echo "$KERNEL" | grep -oP 'rc\K[0-9]+' || echo "99")
  if [[ $RC -ge 1 && $RC -le 4 ]]; then
    echo "[!] VULNERABLE — kernel 7.0-rc$RC is in the affected range (7.0-rc1 through rc4)"
    exit 1
  elif [[ $RC -ge 5 ]] || [[ $PATCH -ge 0 && "$KERNEL" != *rc* ]]; then
    echo "[+] PATCHED — kernel 7.0-rc$RC / 7.0.x is at or above the fix (7.0-rc5)"
    exit 0
  fi
fi

# 6.12.x branch
if [[ $MAJOR -eq 6 && $MINOR -eq 12 ]]; then
  if [[ $PATCH -ge 75 && $PATCH -le 79 ]]; then
    echo "[!] VULNERABLE — kernel 6.12.$PATCH is in the affected range (6.12.75–6.12.79)"
    exit 1
  elif [[ $PATCH -ge 80 ]]; then
    echo "[+] PATCHED — kernel 6.12.$PATCH is at or above the fix (6.12.80)"
    exit 0
  else
    echo "[+] PATCHED — kernel 6.12.$PATCH predates the vulnerable code (introduced at 6.12.75)"
    exit 0
  fi
fi

# 6.18.x branch
if [[ $MAJOR -eq 6 && $MINOR -eq 18 ]]; then
  if [[ $PATCH -ge 16 && $PATCH -le 20 ]]; then
    echo "[!] VULNERABLE — kernel 6.18.$PATCH is in the affected range (6.18.16–6.18.20)"
    exit 1
  elif [[ $PATCH -ge 21 ]]; then
    echo "[+] PATCHED — kernel 6.18.$PATCH is at or above the fix (6.18.21)"
    exit 0
  else
    echo "[+] PATCHED — kernel 6.18.$PATCH predates the vulnerable code (introduced at 6.18.16)"
    exit 0
  fi
fi

# 6.19.x branch
if [[ $MAJOR -eq 6 && $MINOR -eq 19 ]]; then
  if [[ $PATCH -ge 6 && $PATCH -le 10 ]]; then
    echo "[!] VULNERABLE — kernel 6.19.$PATCH is in the affected range (6.19.6–6.19.10)"
    exit 1
  elif [[ $PATCH -ge 11 ]]; then
    echo "[+] PATCHED — kernel 6.19.$PATCH is at or above the fix (6.19.11)"
    exit 0
  else
    echo "[+] PATCHED — kernel 6.19.$PATCH predates the vulnerable code (introduced at 6.19.6)"
    exit 0
  fi
fi

# Check for Ubuntu-specific kernel (6.8.x on 24.04)
if [[ $MAJOR -eq 6 && $MINOR -eq 8 ]]; then
  # Ubuntu 24.04 backport — check dpkg version if available
  if command -v dpkg &>/dev/null; then
    PKG_VER=$(dpkg -l linux-image-"$KERNEL" 2>/dev/null | awk '/^ii/{print $3}' || echo "")
    if [[ -n "$PKG_VER" ]]; then
      echo "[*] Ubuntu package version: $PKG_VER"
      # Fixed in 6.8.0-136.136
      PKG_BUILD=$(echo "$PKG_VER" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+-\K[0-9]+' || echo "0")
      if [[ $PKG_BUILD -ge 136 ]]; then
        echo "[+] PATCHED — Ubuntu package $PKG_VER includes the fix (>= 6.8.0-136)"
        exit 0
      else
        echo "[!] VULNERABLE — Ubuntu package $PKG_VER is below the fix (6.8.0-136.136)"
        exit 1
      fi
    fi
  fi
  echo "[?] UNKNOWN — kernel 6.8.x detected but could not determine distro patch level"
  exit 2
fi

# All other kernels — not in known affected ranges
if [[ $MAJOR -lt 6 ]]; then
  echo "[+] PATCHED — kernel $MAJOR.$MINOR.$PATCH predates the vulnerable code entirely"
  exit 0
fi

if [[ $MAJOR -eq 6 && $MINOR -lt 12 ]]; then
  echo "[+] PATCHED — kernel 6.$MINOR.$PATCH is not in any affected branch"
  exit 0
fi

echo "[?] UNKNOWN — kernel $MAJOR.$MINOR.$PATCH not in a recognized affected or fixed range. Check manually."
exit 2