NetSight
IP …
medium5.5

CVE-2026-43333

In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO…

Impact

In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.15.37 before 5.15.203
from 5.16.11 before 6.1.168
from 6.2 before 6.6.134
from 6.7 before 6.12.81
from 6.13 before 6.18.22
from 6.19 before 6.19.12

Weakness classification

CWE-476

References