CVE-2026-43333 bpf: reject direct access to nullable PTR_TO_BUF pointers
A missing null check in the Linux kernel BPF verifier allows attackers to trigger a kernel crash via map iterator stop callbacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43333?
CVE-2026-43333 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject direct access to nullable PTR_TO_BUF pointers
check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check.
Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference.
Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
Weakness: CWE-476
Which versions are affected by CVE-2026-43333?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43333?
Apply the vendor's patch.
Is CVE-2026-43333 being exploited?
There is no known exploitation of CVE-2026-43333 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43333, DEBIAN-CVE-2026-43333, GHSA-2cxw-35rj-wxq7, ROOT-OS-UBUNTU-2204-CVE-2026-43333, ROOT-OS-UBUNTU-2404-CVE-2026-43333, UBUNTU-CVE-2026-43333.