Skip to main content

Linux Kernel CVE-2026-43005

| EUVDEUVD-2026-26604 HIGH
Out-of-bounds Read (CWE-125)
2026-05-01 Linux
Buffer Overflow Information Disclosure Linux
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
3.6 LOW

Local, low-priv access (AV:L/PR:L); AC:H because it hinges on hardware returning a zero-length read; a one-byte stack under-read gives at most low info leak and low availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:14 vuln.today
CVSS changed
May 12, 2026 - 19:37 NVD
7.1 (HIGH)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26604
CVE Published
May 01, 2026 - 14:15 nvd
HIGH 7.1
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (tps53679) Fix array access with zero-length block read

i2c_smbus_read_block_data() can return 0, indicating a zero-length read. When this happens, tps53679_identify_chip() accesses buf[ret - 1] which is buf[-1], reading one byte before the buffer on the stack.

Fix by changing the check from "ret < 0" to "ret <= 0", treating a zero-length read as an error (-EIO), which prevents the out-of-bounds array access.

Also fix a typo in the adjacent comment: "if present" instead of duplicate "if".

AnalysisAI

Out-of-bounds memory read in the Linux kernel's tps53679 hwmon driver allows local low-privileged users interacting with a TI TPS53679-family voltage regulator on the I2C/PMBus to trigger a one-byte stack under-read. When i2c_smbus_read_block_data() returns a zero-length block read, tps53679_identify_chip() indexes buf[ret-1] (buf[-1]), reading one byte before the on-stack buffer, which can corrupt driver logic or leak adjacent stack data. No public exploit identified at time of analysis and EPSS is negligible (0.02%), consistent with a hardware-dependent, non-remote kernel defect rather than an internet-facing threat.

Technical ContextAI

The affected component is the tps53679 hardware monitoring (hwmon) driver, which manages Texas Instruments TPS53679/TPS53681-class multiphase PMBus voltage regulators over the SMBus/I2C bus. During chip identification, tps53679_identify_chip() issues an SMBus block read via i2c_smbus_read_block_data(). This helper returns the number of bytes read, and per the SMBus specification a block read can legitimately return 0. The code guarded only against negative returns (ret < 0) and then dereferenced buf[ret - 1] to inspect the final byte; with ret == 0 this becomes buf[-1], an access one element before the stack buffer. This is a classic CWE-125 (Out-of-bounds Read), rooted in trusting a length value from a peripheral device without validating the zero case. The fix changes the guard to ret <= 0 and treats a zero-length read as -EIO. The CPE data identifies the affected product simply as cpe:2.3:a:linux:linux, i.e., the mainline Linux kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.22 or later in the 6.18 series, 6.19.12 or later in the 6.19 series, or mainline 7.0, which change the length check from 'ret < 0' to 'ret <= 0' and return -EIO on a zero-length read. The upstream fix commits are available at https://git.kernel.org/stable/c/79b7e588399bb55f4c10bea6ca41b6c3b944d2bb, https://git.kernel.org/stable/c/6999b4769e2a61c463158927102e8c07e3f69ba2, and https://git.kernel.org/stable/c/0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6; Red Hat and SUSE users should apply their distribution's corresponding kernel errata. If patching must be deferred and the hardware does not actually use a TPS53679-family regulator, a compensating control is to blacklist/unload the tps53679 module (e.g., add it to modprobe blacklist) so the vulnerable probe path is never reached - the trade-off is loss of hardware monitoring/telemetry for any genuine TPS53679 device on that system. Physically and logically restricting who can attach or reconfigure I2C/SMBus devices also reduces the already-limited attack surface.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43005 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy