CVE-2026-43070 bpf: Reset register ID for BPF_END value tracking
A flaw in the Linux kernel BPF verifier allows out-of-bounds memory access due to incorrect scalar value tracking during byte swap operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43070?
CVE-2026-43070 is a high-severity memory corruption vulnerability in Linux kernel, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reset register ID for BPF_END value tracking
When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar ID with another register (e.g., after an `r1 = r0` assignment), this tie must be broken.
Currently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END. Consequently, if a conditional jump checks the swapped register, the verifier incorrectly propagates the learned bounds to the linked register, leading to false confidence in the linked register's value and potentially allowing out-of-bounds memory accesses.
Fix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case to break the scalar tie, similar to how BPF_NEG handles it via `__mark_reg_known`.
Weakness: CWE-125
Which versions are affected by CVE-2026-43070?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43070?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43070 being exploited?
There is no known exploitation of CVE-2026-43070 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43070, DEBIAN-CVE-2026-43070, GHSA-vc3m-hcq5-8vhr, UBUNTU-CVE-2026-43070.