PT-2026-37073 · Linux · Linux Kernel

Published 2026-05-05 · Updated 2026-05-29 · CVE-2026-43070

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF (Berkeley Packet Filter) verifier where the dst reg->id is not reset to 0 during a BPF END (byte swap) operation. When a register undergoes this operation, its scalar value is mutated in-place. If the register shared a scalar ID with another register, the failure to break this tie allows the verifier to incorrectly propagate learned bounds to the linked register during a conditional jump. This can lead to false confidence in the register's value, potentially enabling out-of-bounds memory accesses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-43070

Affected Products

Linux Kernel

References · 13

• https://security-tracker.debian.org/tracker/CVE-2026-43070 · Vendor Advisory
• https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43070 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43070 · Security Note
• https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43070 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43070 · Vendor Advisory
• https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43070 · Security Note
• https://t.me/CVEtracker/52756 · Telegram Post
• https://git.kernel.org/linus/a3125bc01884431d30d731461634c8295b6f0529 · Note
• https://t.me/cveNotify/162337 · Telegram Post
• https://t.me/cveNotify/165240 · Telegram Post