Skip to main content

Linux Kernel CVE-2026-43175

| EUVDEUVD-2026-27737 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-7x44-cvrw-474f
Buffer Overflow Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by hardware-bound driver context; PR:L for low-privilege local trigger; A:H for reliable kernel panic; no confidentiality or integrity impact demonstrated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:08 vuln.today
CVSS changed
May 12, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841

The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else there is going to be out of bounds write when pointers 4..7 are set into struct rs9_driver_data .clk_dif[4..7] field.

Since there are other structure members past this struct clk_hw pointer array, writing to .clk_dif[4..7] fields corrupts both the struct rs9_driver_data content and data around it, sometimes without crashing the kernel. However, the kernel does surely crash when the driver is unbound or during suspend.

Fix this, increase the struct clk_hw pointer array size to the maximum output count of 9FGV0841, which is the biggest chip that is supported by this driver.

AnalysisAI

Out-of-bounds write in the Linux kernel's clk/rs9 clock driver corrupts kernel memory on systems equipped with the Renesas 9FGV0841 clock chip, reliably crashing the kernel during driver unbind or suspend. The rs9_driver_data structure allocated only 4 slots for clk_hw pointers but the 9FGV0841 exposes 8 outputs, so registering outputs 4-7 silently overwrites adjacent kernel memory. No public exploit exists and no active exploitation is confirmed (not in CISA KEV); EPSS is 0.02% (5th percentile), reflecting the hardware-specific and local-only attack surface.

Technical ContextAI

The clk/rs9 driver supports the IDT/Renesas family of programmable clock generators, including the 9FGV0841, via I2C. The driver maintains an array of struct clk_hw pointers (clk_dif[]) within rs9_driver_data to track registered clock outputs. The 9FGV0841 has 8 differential outputs, but the array was sized for fewer entries - leaving indices 4 through 7 outside valid array bounds. CWE-476 (Null Pointer Dereference) is cited but does not accurately characterize this flaw; the root cause is an undersized buffer causing out-of-bounds writes (more precisely CWE-787), overwriting adjacent struct members and heap data. Because C does not perform bounds checking, the writes succeed silently until the corrupted data is later dereferenced - typically during driver unbind or kernel suspend, at which point a kernel panic occurs. The affected commit range begins at f0e5e1800204b82af6d3e8ef03012ab4afc22358 when the 9FGV0841 support was introduced.

RemediationAI

The primary fix is to update the Linux kernel to a patched stable release: 6.12.75, 6.18.16, 6.19.6, or 7.0. Upstream commits are available at https://git.kernel.org/stable/c/2f926875dffe2226ea26d129e16d9092cccd03aa (one branch), https://git.kernel.org/stable/c/da86ca15d7389ee0b5df08e8f70c39354e6b8a4b, https://git.kernel.org/stable/c/82a34f344999d8029bcebf131028fa519140c7cc, and https://git.kernel.org/stable/c/5ec820fc28d0b8a0f3890d476b1976f20e8343cc. Distribution users should apply the vendor kernel update per Ubuntu USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1) or equivalent Red Hat/SUSE errata. If patching is not immediately possible and the system has the 9FGV0841 hardware, a compensating control is to blacklist the rs9 kernel module (add 'blacklist rs9' to /etc/modprobe.d/), which prevents the driver from binding and triggering the OOB write. The trade-off is that clock outputs managed by the 9FGV0841 will be unavailable, potentially disrupting dependent peripherals on the device.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43175 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy