CVE-2026-43010: Linux Kernel Privilege Escalation Flaw

CVE-2026-43010 Overview

CVE-2026-43010 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in bpf_kprobe_multi_link_attach(), which failed to validate whether a program being attached carried the sleepable flag. Because kprobe.multi programs execute in atomic and Read-Copy-Update (RCU) context, attaching a sleepable program allowed sleepable helpers such as bpf_copy_from_user() to run from a non-sleepable context. The result is a kernel BUG: sleeping function called from invalid context warning, signaling unsafe scheduling behavior in interrupt-disabled or RCU-locked code paths.

Critical Impact
Attaching a sleepable BPF program through the multi-kprobe path triggers atomic-context sleep violations, leading to kernel instability and potential denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the multi-kprobe BPF attach path without the sleepable validation check
Distributions shipping unpatched upstream kernels with BPF and kprobe_multi enabled
Systems running BPF tracing workloads that load programs marked with the sleepable flag

Discovery Timeline

2026-05-01 - CVE CVE-2026-43010 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43010

Vulnerability Analysis

The Linux kernel BPF subsystem supports two execution modes for tracing programs: non-sleepable programs that run in atomic or RCU-protected contexts, and sleepable programs that may invoke helpers performing user memory access or page faults. The kprobe.multi link type executes its attached program inside a kprobe handler, which runs with preemption disabled and inside an RCU read-side critical section.

The function bpf_kprobe_multi_link_attach() accepted programs without checking the prog->sleepable flag. A program tagged sleepable could therefore be linked to a multi-kprobe and invoked from atomic context. When such a program called a sleepable helper such as bpf_copy_from_user(), the helper attempted operations that may sleep, triggering the kernel's might_sleep() check at include/linux/uaccess.h:169.

The diagnostic output confirms the violation: in_atomic(): 1, preempt_count: 1, and RCU nest depth: 2. Each indicator shows the kernel was inside a non-sleepable region when the sleeping function executed.

Root Cause

The root cause is a missing input validation check [CWE-20] at the BPF link attach boundary. The attach path did not enforce the contract that kprobe.multi execution context cannot host sleepable programs. The mismatch between program flag semantics and runtime context allowed unsafe helper invocation.

Attack Vector

Local exploitation requires the ability to load BPF programs, typically gated by CAP_BPF or CAP_SYS_ADMIN. A privileged local user or a compromised workload with BPF capabilities can construct a sleepable BPF program, attach it through the multi-kprobe link interface, and trigger the atomic-context sleep, destabilizing the kernel. The fix rejects sleepable programs early in bpf_kprobe_multi_link_attach() before any further processing occurs.

No verified public proof-of-concept code is available. See the upstream commits for the full patch: Linux Kernel Fix Commit, Linux Kernel Patch, and Linux Kernel Commit Update.

Detection Methods for CVE-2026-43010

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
dmesg output showing in_atomic(): 1 paired with a non-zero RCU nest depth during BPF program execution
Unexpected loading of sleepable BPF programs followed by attachment to kprobe_multi links

Detection Strategies

Monitor bpf() syscall activity and link creation events using audit rules or kernel tracing for sleepable program flags combined with BPF_TRACE_KPROBE_MULTI attach types
Alert on kernel ring buffer messages indicating might_sleep violations or atomic-context faults originating from BPF helpers
Inventory loaded BPF programs with bpftool prog show and review program types and flags on production hosts

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log pipeline and alert on sleeping-in-atomic-context strings
Track which users and workloads hold CAP_BPF or CAP_SYS_ADMIN and review for least-privilege deviations
Correlate kernel warning events with the process identifiers responsible for BPF program loading

How to Mitigate CVE-2026-43010

Immediate Actions Required

Apply the upstream Linux kernel patch that rejects sleepable programs in bpf_kprobe_multi_link_attach() and reboot affected systems
Track distribution security trackers for backported kernels and schedule maintenance windows accordingly
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted system components and operators only

Patch Information

The fix was committed upstream and adds an early rejection of sleepable programs at attach time. Reference the Linux Kernel Fix Commit, the related Linux Kernel Patch, and the Linux Kernel Commit Update. Apply vendor-supplied stable kernel updates that include these commits.

Workarounds

Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl until patches are deployed
Remove CAP_BPF from container runtimes and workloads that do not require BPF tracing
Avoid loading BPF programs marked sleepable on hosts running unpatched kernels with kprobe_multi enabled

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo bpftool prog show