Stable kernels get BPF verifier fix for ld_abs/ind in subprogs

Stable series 6.6, 6.12, and 6.18 are receiving a backport of CVE-2026-53090, a BPF verifier flaw in how legacy packet-load instructions behave inside subprograms.

The instructions ld_abs and ld_ind may appear in subprogs only when those subprogs are BTF-annotated and return a scalar. Their code generation still carries an abnormal exit path from cBPF days: on a failed packet data load the program sets r0 to zero and returns. The verifier enforced the scalar-return rule but did not explore that failure path. As a result it could miss invalid register use that only appears when the load fails.

Daniel Borkmann fixed the gap by having the verifier simulate both outcomes, pushing the success path for later checks and treating the r0=0 return as the fall-through case, similar to tail-call handling. STAR Labs SG reported the issue. The backport also lands selftests that cover early exit on load failure, safe dual-path subprogs, and rejection of void-return subprogs.