CVE-2026-43070 (GCVE-0-2026-43070)

Vulnerability from cvelistv5 – Published: 2026-05-05 15:23 – Updated: 2026-08-05 12:25
VLAI
Title
bpf: Reset register ID for BPF_END value tracking
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register ID for BPF_END value tracking When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar ID with another register (e.g., after an `r1 = r0` assignment), this tie must be broken. Currently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END. Consequently, if a conditional jump checks the swapped register, the verifier incorrectly propagates the learned bounds to the linked register, leading to false confidence in the linked register's value and potentially allowing out-of-bounds memory accesses. Fix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case to break the scalar tie, similar to how BPF_NEG handles it via `__mark_reg_known`.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4c03342e5ac532fb34d13a7b51dd7261dfc48963 , < a17443af874229408ce6b78e2c8a2b5adeb4b7d8 (git)
Affected: d00ce96623a69a100ad79675d0e85fda3c50d89b , < 0d15c3611a2cc5d08993545d4032055ae10ae2c1 (git)
Affected: 9d21199842247ab05c675fb9b6c6ca393a5c0024 , < a3125bc01884431d30d731461634c8295b6f0529 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18.17 , < 6.18.21 (semver)
Affected: 6.19.7 , < 6.19.11 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a17443af874229408ce6b78e2c8a2b5adeb4b7d8",
              "status": "affected",
              "version": "4c03342e5ac532fb34d13a7b51dd7261dfc48963",
              "versionType": "git"
            },
            {
              "lessThan": "0d15c3611a2cc5d08993545d4032055ae10ae2c1",
              "status": "affected",
              "version": "d00ce96623a69a100ad79675d0e85fda3c50d89b",
              "versionType": "git"
            },
            {
              "lessThan": "a3125bc01884431d30d731461634c8295b6f0529",
              "status": "affected",
              "version": "9d21199842247ab05c675fb9b6c6ca393a5c0024",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.18.21",
              "status": "affected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.19.11",
              "status": "affected",
              "version": "6.19.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.18.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.19.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg-\u003eid` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register\u0027s value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg-\u003eid` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable verifier logic is reached by a local attacker through the bpf() syscall when loading an eBPF program, not by remote packets directly.\nAC:L - The attacker controls the BPF bytecode and can construct the shared scalar-ID plus BPF_END pattern; there is no race or external timing condition required beyond program execution.\nPR:L - A basic local user can reach this in deployments with unprivileged BPF enabled or delegated BPF token capability; if uncertain between requiring CAP_BPF and unprivileged reachability, the higher-severity PR:L is appropriate.\nUI:N - No victim action is required; the attacker loads and triggers the BPF program themselves.\nS:U - The impact is within the kernel security authority, matching a standard local kernel privilege escalation rather than a cross-scope escape.\nC:H - The verifier can incorrectly validate out-of-bounds memory accesses, and such memory corruption/read primitives can expose arbitrary kernel memory.\nI:H - The demonstrated bad bounds propagation permits out-of-bounds writes through BPF pointer arithmetic, which is defensibly exploitable for kernel memory corruption or code execution.\nA:H - Out-of-bounds kernel memory access can crash or panic the kernel even if not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:43.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"
        }
      ],
      "title": "bpf: Reset register ID for BPF_END value tracking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43070",
    "datePublished": "2026-05-05T15:23:28.819Z",
    "dateReserved": "2026-05-01T14:12:55.982Z",
    "dateUpdated": "2026-08-05T12:25:43.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43070",
      "date": "2026-09-21",
      "epss": "0.00118",
      "percentile": "0.01973"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a17443af874229408ce6b78e2c8a2b5adeb4b7d8",
                    "status": "affected",
                    "version": "4c03342e5ac532fb34d13a7b51dd7261dfc48963",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d15c3611a2cc5d08993545d4032055ae10ae2c1",
                    "status": "affected",
                    "version": "d00ce96623a69a100ad79675d0e85fda3c50d89b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3125bc01884431d30d731461634c8295b6f0529",
                    "status": "affected",
                    "version": "9d21199842247ab05c675fb9b6c6ca393a5c0024",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.18.21",
                    "status": "affected",
                    "version": "6.18.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.19.11",
                    "status": "affected",
                    "version": "6.19.7",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870",
                    "versionEndExcluding": "6.18.21",
                    "versionStartIncluding": "6.18.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F154E5F-DF7A-4EB9-BAFA-13EC093D679A",
                    "versionEndExcluding": "6.19.11",
                    "versionStartIncluding": "6.19.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg-\u003eid` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register\u0027s value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg-\u003eid` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."
          }
        ],
        "id": "CVE-2026-43070",
        "lastModified": "2026-06-17T10:48:52.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-05T16:16:16.320",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:16:52+00:00",
      "cve": "CVE-2026-43070",
      "id": "CVE-2026-43070",
      "initial_release_date": "2026-05-05T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Reset register ID for BPF_END value tracking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43070.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:21:46Z",
      "cve": "CVE-2026-43070",
      "id": "CVE-2026-43070",
      "initial_release_date": "2026-05-06T01:40:32Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43070",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43070.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.