Homepage

Access of Resource Using Incompatible Type ('Type Confusion') The advisory has been revoked - it doesn't affect any version of package perf6.18-debuginfo  (opens in a new tab)

Threat Intelligence

EPSS
0.12% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-PERF618DEBUGINFO-16742144
  • published18 May 2026
  • disclosed8 May 2026
Report a new vulnerability Found a mistake?

Introduced: 8 May 2026

CVE-2026-43306  (opens in a new tab)
CWE-843  (opens in a new tab)

Amendment

The Amazon-Linux security team deemed this advisory irrelevant for Amazon-Linux:2023.

NVD Description

Note: Versions mentioned in the description apply only to the upstream perf6.18-debuginfo package and not the perf6.18-debuginfo package as distributed by Amazon-Linux.

In the Linux kernel, the following vulnerability has been resolved:

bpf: crypto: Use the correct destructor kfunc type

With CONFIG_CFI enabled, the kernel strictly enforces that indirect function calls use a function pointer type that matches the target function. I ran into the following type mismatch when running BPF self-tests:

CFI failure at bpf_obj_free_fields+0x190/0x238 (target: bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc) Internal error: Oops - CFI: 00000000f2008228 [#1] SMP ...

As bpf_crypto_ctx_release() is also used in BPF programs and using a void pointer as the argument would make the verifier unhappy, add a simple stub function with the correct type and register it as the destructor kfunc instead.