CVE-2026-43321: Linux Kernel Privilege Escalation Flaw

CVE-2026-43321 Overview

CVE-2026-43321 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier. The flaw exists in the compute_insn_live_regs() function, which fails to mark the rX register as used for gotox rX indirect jump instructions. This incorrect liveness tracking can lead to verifier state inconsistencies during BPF program validation. Local authenticated attackers with the ability to load BPF programs can leverage the issue to impact confidentiality, integrity, and availability of the host system.

Critical Impact

A local attacker with BPF load privileges can exploit incorrect live register marking in the BPF verifier to compromise kernel memory safety on Linux kernel 7.0 release candidates.

Affected Products

• Linux Kernel 7.0-rc1 through 7.0-rc7
• Linux Kernel mainline builds containing the indirect jump (gotox) BPF instruction handling
• Distributions shipping pre-release 7.0 kernels with BPF support enabled

Discovery Timeline

• 2026-05-08 - CVE-2026-43321 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43321

Vulnerability Analysis

The vulnerability resides in the BPF verifier's live register computation logic. The compute_insn_live_regs() function determines which registers are live at each instruction during static analysis of BPF programs. For indirect jump instructions of the form gotox rX, the target address is stored in register rX. The verifier must mark rX as used so the register's value is preserved across the jump for downstream analysis.

The pre-patch implementation omits this marking. As a result, the verifier's view of register liveness diverges from runtime behavior at the gotox instruction. This inconsistency can be leveraged to bypass verifier safety checks, leading to kernel memory corruption [CWE-noinfo].

Root Cause

The root cause is missing register-use tracking inside compute_insn_live_regs() for the BPF_JMP | BPF_JA indirect variant (gotox). Because the target register is not added to the live set, subsequent dataflow analysis treats it as dead. This produces unsound verifier conclusions about register state at jump targets.

Attack Vector

Exploitation requires local access and the ability to load BPF programs, typically CAP_BPF or CAP_SYS_ADMIN. An attacker crafts a malicious BPF program containing a gotox instruction designed to exploit the inconsistent liveness analysis. The verifier accepts the program, but at runtime register state diverges from what was statically validated. The fix is applied in upstream commits 7beae54111c3 and d1aab1ca576c. See the kernel git commit 7beae54111c3 and kernel git commit d1aab1ca576c for details.

No public proof-of-concept exploit code is available. The vulnerability is described in prose because no verified exploitation code has been published.

Detection Methods for CVE-2026-43321

Indicators of Compromise

• Unexpected loading of BPF programs by non-root users with CAP_BPF granted
• Kernel oops or panic messages referencing bpf_verifier, check_cfg, or compute_insn_live_regs
• BPF programs containing indirect jumps (gotox) loaded by untrusted workloads

Detection Strategies

• Audit bpf() syscall activity using auditd rules to log BPF_PROG_LOAD invocations
• Monitor /sys/kernel/debug/tracing/events/bpf/ tracepoints for anomalous program loads
• Correlate unprivileged container workloads requesting BPF capabilities with kernel version metadata

Monitoring Recommendations

• Track kernel version inventory to identify hosts running Linux 7.0-rc1 through 7.0-rc7
• Alert on processes invoking bpf() syscall outside of approved observability or networking tooling
• Forward kernel logs to a centralized data lake for retrospective analysis of verifier-related crashes

How to Mitigate CVE-2026-43321

Immediate Actions Required

• Upgrade affected hosts to a Linux kernel build that includes commits 7beae54111c3 and d1aab1ca576c
• Restrict CAP_BPF and CAP_SYS_ADMIN to trusted system processes only
• Set kernel.unprivileged_bpf_disabled=1 via sysctl to block unprivileged BPF program loading

Patch Information

The upstream fix marks rX as used inside compute_insn_live_regs() when processing gotox rX instructions. Apply the patches referenced in the kernel.org stable commit 7beae54111c3 and kernel.org stable commit d1aab1ca576c. Rebuild and redeploy the kernel, then reboot affected hosts.

Workarounds

• Disable unprivileged BPF using sysctl -w kernel.unprivileged_bpf_disabled=1 until the kernel is patched
• Remove CAP_BPF from container runtimes and seccomp profiles for untrusted workloads
• Roll back to a stable 6.x kernel series if production hosts are running 7.0 release candidates

# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf

# Verify the setting is active
sysctl kernel.unprivileged_bpf_disabled