Skip to main content

Linux Kernel CVE-2026-43281

| EUVDEUVD-2026-27680 HIGH
Out-of-bounds Read (CWE-125)
2026-05-06 Linux GHSA-78gq-46gf-2hpp
Buffer Overflow Information Disclosure Linux
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local access with low privilege triggers an unbounded read (no UI), yielding kernel memory disclosure (C:H) and potential panic (A:H) with no write primitive (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:41 vuln.today
CVSS changed
May 08, 2026 - 19:22 NVD
7.1 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:29 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Although it is guided that #mbox-cells must be at least 1, there are many instances of #mbox-cells = <0>; in the device tree. If that is the case and the corresponding mailbox controller does not provide fw_xlate and of_xlate function pointers, fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's mailbox subsystem allows a local low-privileged attacker to read adjacent kernel memory or crash the system by exercising the default fw_mbox_index_xlate() translation function. The flaw affects platforms whose device tree declares '#mbox-cells = <0>' on a mailbox controller that supplies neither an fw_xlate nor of_xlate handler, so the generic index translator runs without a bounds check. EPSS is negligible (0.02%, 7th percentile) and no public exploit has been identified, but a stable-tree patch is available across multiple kernel branches.

Technical ContextAI

The Linux mailbox framework brokers inter-processor communication between a host CPU and firmware/co-processors. When a consumer requests a channel, the controller's .of_xlate (or firmware .fw_xlate) callback translates the device-tree specifier into a channel index; if a controller provides neither callback, the framework falls back to fw_mbox_index_xlate(), which treats the first specifier cell as a raw channel index. The device-tree binding requires '#mbox-cells' to be at least 1, but in practice many trees set it to 0, meaning no index cell is passed, and the default translator indexes the channel array without validating the value against the controller's channel count. This is a classic CWE-125 out-of-bounds read: the missing bounds check lets an attacker-influenced or malformed index reference memory outside the mbox_chan[] array.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 6.1.167, 6.6.130, 6.12.77, 6.18.16, 6.19.6, or 7.0 (or later) - matching your maintained branch, and consume it via your distribution (for example the Ubuntu fix in USN-8567-1, https://ubuntu.com/security/notices/USN-8567-1). The upstream fix adds a bounds check in fw_mbox_index_xlate(); reference commits are at https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310 and the other stable hashes listed in the CVE. As a compensating control until reboot into a patched kernel, audit device trees for mailbox controllers declaring '#mbox-cells = <0>' and correct them to at least 1 in line with the binding, or ensure the relevant controller driver supplies an of_xlate/fw_xlate callback so the vulnerable default path is not used; the trade-off is that editing device trees requires a firmware/DTB rebuild and reboot and is platform-specific. Because the attack requires local access, also restrict local shell access on affected embedded/multi-tenant systems.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43281 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy