Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernel

Impact

check_mem_access() matched PTR_TO_BUF through base_type(), which strips PTR_MAYBE_NULL, so the verifier accepted a direct dereference of a pointer that can legitimately be NULL. BPF map iterator ctx->key and ctx->value are NULL on the stop callback, so a program the verifier approved takes a NULL dereference in kernel context and panics the host. Anyone able to load a map-iterator BPF program - the observability and networking agents that run privileged on every GPU node, and whoever can reach them - can take the whole node down, killing the co-tenant jobs with it. This is a crash, not a privilege escalation: the verifier gap is a missing null check, not a bounds bypass.

Who can reach it

Local, and requires enough privilege to load a BPF map iterator program (CAP_BPF/CAP_SYS_ADMIN in the relevant namespace). The realistic path on a fleet is a privileged DaemonSet agent or an operator-supplied program, not an unprivileged tenant pod.

What to do

Apply the stable kernel update that adds the type_may_be_null() guard to the PTR_TO_BUF branch and reboot each node; the verifier lives in the kernel image, so there is no way to fix it without a reboot. Until then, keep BPF program loading restricted to trusted agents (unprivileged_bpf_disabled, no CAP_BPF for tenant workloads).

References

Related entries

• Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON unitsCVE-2026-43344 · Linux kernel perf/x86/intel/uncore (die ID init and lookup on Intel SPR/EMR)Medium
• Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardownCVE-2026-43351 · Linux kernel KVM arm64 vGIC (dist/redist initialisation on create failure)Medium
• Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memoryCVE-2026-43419 · Linux kernel CephFS client (ceph_mdsc_build_path error paths)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel KVM on AMD: stale CR8 write intercept after AVIC activation desynchronises guest TPRCVE-2026-43483 · Linux kernel KVM/SVM (CR8 write interception vs AVIC activation)Medium
• Linux kernel BPF cgroup storage: bogus pointer read and key copied to userspace at end of listCVE-2026-45838 · Linux kernel BPF (cgroup_storage_get_next_key() end-of-list detection)Medium