Medium 5.5Published May 8, 2026

CVE-2026-43306bpf: crypto: Use the correct destructor kfunc type

Updated under an hour ago (Oct 27, 2026, 9:20 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: crypto: Use the correct destructor kfunc type With CONFIG_CFI enabled, the kernel strictly enforces that indirect function calls use a function pointer type that matches the target function. I ran into the following type mismatch when running BPF self-tests: CFI failure at bpf_obj_free_fields+0x190/0x238 (target: bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc) Internal error: Oops - CFI: 00000000f2008228 [#1] SMP ... As bpf_crypto_ctx_release() is also used in BPF programs and using a void pointer as the argument would make the verifier unhappy, add a simple stub function with the correct type and register it as the destructor kfunc instead.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3e1c6f35409f9e447bf37f64840f5b65576bfb78 before 4e3e57dbf46dad3498f8c4219ce2dba756875962; from 3e1c6f35409f9e447bf37f64840f5b65576bfb78 before 50d6fd69388cc7b05dce72f09080674dcede4ac9; from 3e1c6f35409f9e447bf37f64840f5b65576bfb78 before 3979a550fe06b370d73647f59cf462fa525c9ec4; from 3e1c6f35409f9e447bf37f64840f5b65576bfb78 before b40a5d724f29fc2eed23ff353808a9aae616b48a	CNA record
linux linux_kernel linux:linux_kernel	from 6.10 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/4e3e57dbf46dad3498f8c4219ce2dba756875962	patch
https://git.kernel.org/stable/c/50d6fd69388cc7b05dce72f09080674dcede4ac9	patch
https://git.kernel.org/stable/c/3979a550fe06b370d73647f59cf462fa525c9ec4	patch
https://git.kernel.org/stable/c/b40a5d724f29fc2eed23ff353808a9aae616b48a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.