CVE-2026-43030

bpf: Fix regsafe() for pointers to packet

State: Published
Severity: 7.8 High
Published: May 1, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix regsafe() for pointers to packet

In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N regsafe() may return true which may lead to current state with valid packet range not being explored. Fix the bug.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-682 Incorrect Calculation

Affected Products

Product	Versions
LinuxLinux	95b6ec733752b31bfd166c4609d2c1b5cdde9b47 to before b52f6d0ef7b308f9d05bbddb78749852f28e8e40Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 37db6b9726d0bcf91cbdf9d63b558c50da49f968Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 015a74476dc1ab6923d89f1ee009aaf43faa7185Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before b99d82706bd1511bb875e3de7154698fd9215c99Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 7241da033fdc507b920e092dab1f97b945cb0370Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 8aebe18069394f4a79d2d82080a0f806da449996Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before ca995b1462ec6db1e869100ba1fb7356bd3f22f0Affected 6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before a8502a79e832b861e99218cbd2d8f4312d62e225Affected 5.10.155 to before 5.10.253Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

95b6ec733752b31bfd166c4609d2c1b5cdde9b47 to before b52f6d0ef7b308f9d05bbddb78749852f28e8e40Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 37db6b9726d0bcf91cbdf9d63b558c50da49f968Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 015a74476dc1ab6923d89f1ee009aaf43faa7185Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before b99d82706bd1511bb875e3de7154698fd9215c99Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 7241da033fdc507b920e092dab1f97b945cb0370Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before 8aebe18069394f4a79d2d82080a0f806da449996Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before ca995b1462ec6db1e869100ba1fb7356bd3f22f0Affected
6d94e741a8ff818e5518da8257f5ca0aaed1f269 to before a8502a79e832b861e99218cbd2d8f4312d62e225Affected
5.10.155 to before 5.10.253Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.