Junglewise Threat Intelligence

CVE-2026-43010: Linux Kernel invalid context in BPF kprobe_multi

CVE-2026-43010 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's BPF subsystem could allow a local user to cause a system crash. The issue occurs because certain monitoring programs (kprobes) were allowed to perform 'sleepable' operations in contexts where the system expects immediate, non-blocking execution. This mismatch leads to kernel errors and potential system instability or denial of service.

Technical details

A vulnerability exists in bpf_kprobe_multi_link_attach() within the Linux kernel where the system fails to verify if a BPF program has the sleepable flag set before attachment. kprobe.multi programs execute within atomic or RCU contexts where sleeping is prohibited. By attaching a program with the sleepable flag, an attacker can trigger sleepable helpers (like bpf_copy_from_user) from these non-sleepable contexts. This results in a kernel 'splat' (BUG: sleeping function called from invalid context), which can be leveraged by a local user to cause a kernel panic or denial of service. The fix involves explicitly rejecting sleepable programs during the attachment phase.

Affected products

  • Linux Linux 5.18 to 6.18.21, 6.19.11, 7.0

Timeline

  • 2026-04-02: patched: Initial fix committed to mainline kernel
  • 2026-05-01: disclosed: CVE published

References