Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_END

Impact

When the old register state has range == BEYOND_PKT_END and the current state has a finite range, regsafe() could return true, so the verifier prunes a state with a valid packet range instead of exploring it. State pruning that treats an unexplored path as equivalent is how a program with unsafe packet accesses gets accepted, which puts packet-pointer reads and writes outside their verified bounds. This is the verifier's own safety logic, so it affects every host that lets a workload load BPF programs - including the GPU nodes running BPF-based CNI and observability. The record gives only the one-line fix and no exploit detail; treat the exposure as unsafe packet access rather than a demonstrated escalation chain.

Who can reach it

Local user able to load a BPF program touching packet pointers, which in practice means CAP_BPF/CAP_SYS_ADMIN or a network-program loader exposed to the workload. Not remotely reachable on its own.

What to do

Update the host kernel to a build carrying the stable fix commits below and reboot each node. Until patched, do not grant CAP_BPF or CAP_NET_ADMIN to tenant workloads and keep unprivileged BPF disabled. No vendor advisory beyond the kernel commits is present in the record.

References

Related entries

• Linux kernel authencesn: out-of-place decrypt writes high-order sequence bits into the destination bufferCVE-2026-43033 · Linux kernel crypto API (authencesn template, out-of-place decryption)High
• Linux kernel AF_ALG: af_alg_pull_tsgl can reassign one page past the end of the scatterlistCVE-2026-43078 · Linux kernel crypto API (af_alg_pull_tsgl page reassignment)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
• KVM x86: __get_sregs2() reads PDPTRs without SRCU protection, dereferencing memslots unsafelyCVE-2026-43214 · Linux kernel KVM x86 (__get_sregs2 PDPTR read, missing SRCU protection)High
• Linux kernel vhost-vdpa: ASID equal to ngroups passes validation, giving an out-of-bounds write in vdpa_simCVE-2026-43248 · Linux kernel vhost-vdpa / vdpa_sim (ASID group bound check)High