CVE-2026-43333None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereferenc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject direct access to nullable PTR_TO_BUF pointers
check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check.
Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference.
Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
Linux >= b453361384c2db1c703dacb806d5fd36aec4ceca < 10bc4a4dcded509c5d5c67d497900c3922c604cdLinux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < 21a10c06ffae24cb01fd174a7ab7736001d2ea56Linux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < 8755066f7bd0f4ac46a29d1708c7b20894539252Linux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < 70abd9d118da2f56beb4ec22e3a29becae373535Linux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < 63276547debc4d8a73eefb2c5273b2a905c961b0Linux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < 4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09Linux >= 20b2aff4bc15bda809f994761d5719827d66c0b4 < b0db1accbc7395657c2b79db59fa9fae0d6656f3Linux e982070f8970bb62e69ed7c9cafff886ed200349Linux >= 5.15.37 < 5.15.203Linux >= 5.16.11 < 5.17Linux 5.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses