CVE-2026-43333
bpf: reject direct access to nullable PTR_TO_BUF pointers
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
INFO
Published Date :
May 8, 2026, 2:16 p.m.
Last Modified :
May 15, 2026, 8:07 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the kernel patch for bpf: reject direct access to nullable PTR_TO_BUF pointers.
- Ensure map iterator keys and values are checked for null before access.
- Add type_may_be_null() guards for PTR_TO_BUF branches.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43333.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43333 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43333
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43333 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-43333 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 15, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.22 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.81 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.134 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.37 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16.11 up to (excluding) 6.1.168 Added Reference Type kernel.org: https://git.kernel.org/stable/c/10bc4a4dcded509c5d5c67d497900c3922c604cd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/21a10c06ffae24cb01fd174a7ab7736001d2ea56 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/63276547debc4d8a73eefb2c5273b2a905c961b0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/70abd9d118da2f56beb4ec22e3a29becae373535 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8755066f7bd0f4ac46a29d1708c7b20894539252 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b0db1accbc7395657c2b79db59fa9fae0d6656f3 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern. Added Reference https://git.kernel.org/stable/c/10bc4a4dcded509c5d5c67d497900c3922c604cd Added Reference https://git.kernel.org/stable/c/21a10c06ffae24cb01fd174a7ab7736001d2ea56 Added Reference https://git.kernel.org/stable/c/4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09 Added Reference https://git.kernel.org/stable/c/63276547debc4d8a73eefb2c5273b2a905c961b0 Added Reference https://git.kernel.org/stable/c/70abd9d118da2f56beb4ec22e3a29becae373535 Added Reference https://git.kernel.org/stable/c/8755066f7bd0f4ac46a29d1708c7b20894539252 Added Reference https://git.kernel.org/stable/c/b0db1accbc7395657c2b79db59fa9fae0d6656f3