CVE-2026-43321

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Properly mark live registers for indirect jumps

For a `gotox rX` instruction the rX register should be marked as used in the compute_insn_live_regs() function. Fix this.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-682

Affected software

VendorProductVersions
LinuxLinux>= 493d9e0d608339a32f568504d5fd411a261bb0af, < 7beae54111c34ca63357ef120e115889b915beb5; >= 493d9e0d608339a32f568504d5fd411a261bb0af, < d1aab1ca576c90192ba961094d51b0be6355a4d6
LinuxLinux6.19

References

Timeline

Published
May 8, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-433228.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes tCVE-2026-433235.5In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix zero_vruntime tracking fix John reported that stress-nCVE-2026-433247.8In the Linux kernel, the following vulnerability has been resolved: USB: dummy-hcd: Fix interrupt synchronization error This fixes an erroCVE-2026-433255.5In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't send a 6E related command when not supported CVE-2026-433265.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callCVE-2026-433275.5In the Linux kernel, the following vulnerability has been resolved: USB: dummy-hcd: Fix locking/synchronization error Syzbot testing was aCVE-2026-433287.8In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() errorCVE-2026-433297.8In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions TheCVE-2026-43336.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learCVE-2026-433307.8In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than bCVE-2026-433315.5In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Disable KCOV instrumentation after load_segments() The loadCVE-2026-433327.8In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If ther
CVE-2026-43321: High severity, CVSS 7.8 | Vulnix