Database/Kernel, userspace & hypervisor
Linux kernel BPF verifier: byte swap keeps a stale register link, letting programs pass with out-of-bounds access
Impact
The verifier does not break the scalar ID link between two registers when one of them is byte-swapped with BPF_END. Bounds it learns from a check on the swapped register are then wrongly applied to the linked register. That gives false confidence in the register's value and can let a program that accesses memory out of bounds pass verification. Bugs in this class are a common route from BPF load rights to kernel memory corruption on the host. The real exposure depends on who on the node is allowed to load BPF programs.
Who can reach it
Local user or container that can load BPF programs. Most distributions disable unprivileged BPF by default, so in practice this means holders of CAP_BPF or CAP_SYS_ADMIN, such as privileged pods and observability or networking agents. The default container seccomp profile blocks bpf() for ordinary tenant pods.
What to do
Install a kernel that includes the upstream stable fix, then drain and reboot each node. Until then, keep kernel.unprivileged_bpf_disabled set and do not grant CAP_BPF or CAP_SYS_ADMIN to tenant workloads.
References
Related entries
- Linux kernel AF_ALG: af_alg_pull_tsgl can reassign one page past the end of the scatterlistCVE-2026-43078 · Linux kernel crypto API (af_alg_pull_tsgl page reassignment)High
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
- Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
- KVM x86: __get_sregs2() reads PDPTRs without SRCU protection, dereferencing memslots unsafelyCVE-2026-43214 · Linux kernel KVM x86 (__get_sregs2 PDPTR read, missing SRCU protection)High
- Linux kernel vhost-vdpa: ASID equal to ngroups passes validation, giving an out-of-bounds write in vdpa_simCVE-2026-43248 · Linux kernel vhost-vdpa / vdpa_sim (ASID group bound check)High
- Linux kernel mm: stale page->private survives page free and causes a use-after-free in the swap subsystemCVE-2026-43303 · Linux kernel mm/page_alloc (page->private not cleared in free_pages_prepare)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.