Linux kernel BPF interpreter signed 32-bit division/modulo verifier mismatch

CVE-2026-31525 is a Linux kernel BPF interpreter flaw in the signed 32-bit division and modulo paths (sdiv32/smod32). The vulnerable code uses the kernel abs() macro on s32 operands. Per the kernel's own documentation, abs() is undefined for the minimum value of a signed type. When the destination operand is S32_MIN (0x80000000), abs((s32)DST) exhibits undefined behavior and, on arm64 and x86, returns S32_MIN unchanged. That value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute an incorrect runtime result. The BPF verifier's abstract interpretation logic (including scalar32_min_max_sdiv) derives the mathematically correct result for range tracking, creating a verifier/interpreter mismatch. An attacker able to load a crafted BPF program can exploit this discrepancy to violate verifier assumptions and obtain out-of-bounds access to BPF map values. The upstream fix introduces abs_s32(), which safely handles S32_MIN by casting to u32 before negation, and replaces the affected abs((s32)...) call sites in the interpreter. The issue is specific to signed 32-bit handling; the s64 division/modulo handlers are not affected.