Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) verifier could allow a local attacker to bypass security checks. The BPF verifier is a critical component that ensures user-provided programs are safe to run within the kernel. By exploiting this flaw, an attacker could potentially gain unauthorized access to system memory, leading to data theft or full system compromise.
Technical details
A logic error exists in the Linux kernel's BPF verifier within the `scalar_byte_swap` function in `kernel/bpf/verifier.c`. When a register undergoes a `BPF_END` (byte swap) operation, its scalar value is mutated, but the verifier fails to reset the register's scalar ID (`dst_reg->id`). This causes the verifier to maintain a 'tie' between the mutated register and other registers that previously shared the same ID. If a conditional jump later checks the swapped register, the verifier incorrectly propagates learned bounds to the linked registers. An attacker can leverage this false confidence in register bounds to perform out-of-bounds memory accesses. The issue has been patched by explicitly resetting the register ID to 0 during `BPF_END` operations.
Affected products
- Linux Linux Kernel Versions prior to 6.14 (and various stable branches)
Timeline
- 2026-03-04: disclosed: Initial patch submission by Yazhou Tang
- 2026-03-10: patched: Patch committed to mainline kernel by Alexei Starovoitov
- 2026-05-05: advisory: CVE-2026-43070 published