bpf: reject direct access to nullable PTR_TO_BUF pointers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-43333
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-08 14:16:43 UTC
Updated2026-05-15 20:07:34 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.000240000 probability, percentile 0.070360000 (date 2026-05-12)

Problem Types: CWE-476

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b453361384c2db1c703dacb806d5fd36aec4ceca 10bc4a4dcded509c5d5c67d497900c3922c604cd git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 21a10c06ffae24cb01fd174a7ab7736001d2ea56 git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 8755066f7bd0f4ac46a29d1708c7b20894539252 git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 70abd9d118da2f56beb4ec22e3a29becae373535 git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 63276547debc4d8a73eefb2c5273b2a905c961b0 git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09 git Not specified
CNA Linux Linux affected 20b2aff4bc15bda809f994761d5719827d66c0b4 b0db1accbc7395657c2b79db59fa9fae0d6656f3 git Not specified
CNA Linux Linux affected e982070f8970bb62e69ed7c9cafff886ed200349 git Not specified
CNA Linux Linux affected 5.17 Not specified
CNA Linux Linux unaffected 5.17 semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.168 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.134 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.81 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.22 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.12 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/21a10c06ffae24cb01fd174a7ab7736001d2ea56 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/10bc4a4dcded509c5d5c67d497900c3922c604cd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/70abd9d118da2f56beb4ec22e3a29becae373535 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/63276547debc4d8a73eefb2c5273b2a905c961b0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/8755066f7bd0f4ac46a29d1708c7b20894539252 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b0db1accbc7395657c2b79db59fa9fae0d6656f3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report