In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer spill metadata during half-slot cleanup

__clean_func_state() cleans dead stack slots in 4-byte halves. When the
high half of a STACK_SPILL slot is dead and the low half remains live,
cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears
the saved spilled_ptr metadata.

That conversion is safe only for scalar spills. For a pointer spill, this
metadata clear lets a later 32-bit fill from the still-live half avoid the
normal non-scalar register-fill check and be treated as an ordinary scalar
stack read.

Leave non-scalar spill slots intact in this half-live shape. This is
conservative for pruning and preserves the existing
check_stack_read_fixed_off() rejection path for partial fills from pointer
spills.

https://git.kernel.org/stable/c/0f9278b22cda6fd2525049930157b79b4036b4ef

https://git.kernel.org/stable/c/3a354149bceacadbcf7d7b4766f5ef26a85892ab

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/states.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be23266b4a08540aa43d8503a2ea10247c8daebe","lessThan":"0f9278b22cda6fd2525049930157b79b4036b4ef","versionType":"git","status":"affected"},{"version":"be23266b4a08540aa43d8503a2ea10247c8daebe","lessThan":"3a354149bceacadbcf7d7b4766f5ef26a85892ab","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/states.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]