CVE-2026-43070

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43070", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.982Z", "datePublished": "2026-05-05T15:23:28.819Z", "dateUpdated": "2026-08-05T12:25:43.557Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:43.557Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register's value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable verifier logic is reached by a local attacker through the bpf() syscall when loading an eBPF program, not by remote packets directly.\nAC:L - The attacker controls the BPF bytecode and can construct the shared scalar-ID plus BPF_END pattern; there is no race or external timing condition required beyond program execution.\nPR:L - A basic local user can reach this in deployments with unprivileged BPF enabled or delegated BPF token capability; if uncertain between requiring CAP_BPF and unprivileged reachability, the higher-severity PR:L is appropriate.\nUI:N - No victim action is required; the attacker loads and triggers the BPF program themselves.\nS:U - The impact is within the kernel security authority, matching a standard local kernel privilege escalation rather than a cross-scope escape.\nC:H - The verifier can incorrectly validate out-of-bounds memory accesses, and such memory corruption/read primitives can expose arbitrary kernel memory.\nI:H - The demonstrated bad bounds propagation permits out-of-bounds writes through BPF pointer arithmetic, which is defensibly exploitable for kernel memory corruption or code execution.\nA:H - Out-of-bounds kernel memory access can crash or panic the kernel even if not fully exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "4c03342e5ac532fb34d13a7b51dd7261dfc48963", "lessThan": "a17443af874229408ce6b78e2c8a2b5adeb4b7d8", "status": "affected", "versionType": "git"}, {"version": "d00ce96623a69a100ad79675d0e85fda3c50d89b", "lessThan": "0d15c3611a2cc5d08993545d4032055ae10ae2c1", "status": "affected", "versionType": "git"}, {"version": "9d21199842247ab05c675fb9b6c6ca393a5c0024", "lessThan": "a3125bc01884431d30d731461634c8295b6f0529", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "6.18.17", "lessThan": "6.18.21", "status": "affected", "versionType": "semver"}, {"version": "6.19.7", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.17", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.7", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"}, {"url": "https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"}, {"url": "https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"}], "title": "bpf: Reset register ID for BPF_END value tracking", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a17443af874229408ce6b78e2c8a2b5adeb4b7d8", "status": "affected", "version": "4c03342e5ac532fb34d13a7b51dd7261dfc48963", "versionType": "git"}, {"lessThan": "0d15c3611a2cc5d08993545d4032055ae10ae2c1", "status": "affected", "version": "d00ce96623a69a100ad79675d0e85fda3c50d89b", "versionType": "git"}, {"lessThan": "a3125bc01884431d30d731461634c8295b6f0529", "status": "affected", "version": "9d21199842247ab05c675fb9b6c6ca393a5c0024", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.18.21", "status": "affected", "version": "6.18.17", "versionType": "semver"}, {"lessThan": "6.19.11", "status": "affected", "version": "6.19.7", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F154E5F-DF7A-4EB9-BAFA-13EC093D679A", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register's value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Restablecer ID de registro para el seguimiento de valores BPF_END\n\nCuando un registro se somete a una operaci\u00f3n BPF_END (intercambio de bytes), su valor escalar se muta in situ. Si este registro previamente compart\u00eda un ID escalar con otro registro (por ejemplo, despu\u00e9s de una asignaci\u00f3n \u2019r1 = r0\u2019), este v\u00ednculo debe romperse.\n\nActualmente, el verificador omite restablecer \u2019dst_reg -> id\u2019 a 0 para BPF_END. En consecuencia, si un salto condicional verifica el registro intercambiado, el verificador propaga incorrectamente los l\u00edmites aprendidos al registro vinculado, lo que lleva a una falsa confianza en el valor del registro vinculado y potencialmente permitiendo accesos a memoria fuera de l\u00edmites.\n\nSolucionar esto restableciendo expl\u00edcitamente \u2019dst_reg -> id\u2019 a 0 en el caso BPF_END para romper el v\u00ednculo escalar, similar a c\u00f3mo BPF_NEG lo maneja a trav\u00e9s de \u2019__mark_reg_known\u2019."}], "id": "CVE-2026-43070", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-05T16:16:16.320", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: Reset register ID for BPF_END value tracking", "id": "2466789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466789"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. The verifier fails to correctly reset a register's ID after a BPF_END (byte swap) operation. This oversight can lead to the verifier incorrectly propagating learned memory bounds to other registers, creating false confidence in their values. Consequently, this could enable an attacker to perform out-of-bounds memory accesses, potentially leading to system instability or privilege escalation."], "name": "CVE-2026-43070", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43070\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43070\nhttps://lore.kernel.org/linux-cve-announce/2026050533-CVE-2026-43070-bcf9@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4c03342e5ac532fb34d13a7b51dd7261dfc48963,a17443af874229408ce6b78e2c8a2b5adeb4b7d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d00ce96623a69a100ad79675d0e85fda3c50d89b,0d15c3611a2cc5d08993545d4032055ae10ae2c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9d21199842247ab05c675fb9b6c6ca393a5c0024,a3125bc01884431d30d731461634c8295b6f0529)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.17,6.18.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.7,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-05T18:00:12.703555+00:00", "updated": "2026-05-29T21:30:06.282004+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}