CVE-2026-43030

Vulnerability

Description

CVE-2026-43030 is a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) verifier. The flaw resides in the regsafe() function, which determines if a register state is equivalent to a previous state for verification purposes. When comparing pointers to packet data, if rold->range is BEYOND_PKT_END and rcur->range is a normal value (N), regsafe() could incorrectly return true. This incorrectly treats the current state as already visited, preventing the verifier from exploring paths where the packet pointer has a valid range [1].

Exploitation

Prerequisites

Exploitation requires the ability to load and execute BPF programs, which typically requires CAP_BPF or root privileges. The attacker must craft a specific BPF program that triggers the erroneous comparison in the verifier. No user interaction or network access is needed; the attack is local with low complexity.

Impact

If exploited, an attacker could bypass BPF verifier safety checks, potentially leading to out-of-bounds memory access or other memory corruption issues. This could allow privilege escalation or system compromise. The CVSS v3 score is 7.8 (High), reflecting high impacts on confidentiality, integrity, and availability [2].

Mitigation

Patches have been applied to the stable Linux kernel tree. Users should update to a kernel version containing the fix, which is referenced in commits such as [1], [2], [3], and [4]. No workarounds are documented; upgrading is the recommended action.