CVE-2026-43281

In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d	Patch
https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f	Patch
https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8
https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265	Patch
https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb	Patch
https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd
https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab	Patch
https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:3.18:-::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc2::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc3::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc4::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc5::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc6::::::
	cpe:2.3:o:linux:linux_kernel:3.18:rc7::::::

History

No history.

Information

Published : 2026-05-06 12:16

Updated : 2026-06-17 10:49

NVD link : CVE-2026-43281

Mitre link : CVE-2026-43281

CVE.ORG link : CVE-2026-43281

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-43281", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "2c7ff651ec6b660c7c96a36db9328b3232f555d8", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "ec0874447895b994182a962d2fee9ef075de5efd", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "2662ed331a69c0b551f78af58f12eb629a89a36f", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "31c4c67dec3362094a6747a171a4848e98542265", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "4caae8168d1b808c7d4ff481295292e3f97f90fb", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "fcd7f96c783626c07ee3ed75fa3739a8a2052310", "versionType": "git"}], "programFiles": ["drivers/mailbox/mailbox.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"status": "unaffected", "version": "0", "lessThan": "3.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mailbox/mailbox.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:49.587", "references": [{"url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function."}], "lastModified": "2026-06-17T10:49:18.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF38EC6B-E140-4F00-8705-4F8DFC83958D", "versionEndExcluding": "6.1.167", "versionStartIncluding": "3.18.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C941823-DB24-432E-8F78-90665662756A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E909F0A0-2398-4420-AA63-605C42F5CADF"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77E4C479-2D2C-4009-8D71-18AF50454D7B"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5AE67DB-5E94-4439-98E9-761ACCC48A4A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "777DE673-1457-420F-AAAF-9B1E3AC79328"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "222D33AD-EC2D-4813-83C2-B904534BFCFE"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5F9AEA5-34CE-4ED3-9821-6C7435CE3320"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}