CVE-2026-43281

{"id": "CVE-2026-43281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43281", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:33:16.668371Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "2c7ff651ec6b660c7c96a36db9328b3232f555d8", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "ec0874447895b994182a962d2fee9ef075de5efd", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "2662ed331a69c0b551f78af58f12eb629a89a36f", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "31c4c67dec3362094a6747a171a4848e98542265", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "4caae8168d1b808c7d4ff481295292e3f97f90fb", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "versionType": "git"}, {"status": "affected", "version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c", "lessThan": "fcd7f96c783626c07ee3ed75fa3739a8a2052310", "versionType": "git"}], "programFiles": ["drivers/mailbox/mailbox.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"status": "unaffected", "version": "0", "lessThan": "3.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mailbox/mailbox.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:49.587", "references": [{"url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mailbox: Prevenir el acceso fuera de l\u00edmites en fw_mbox_index_xlate() Aunque se indica que \u201c#mbox-cells\u201d debe ser al menos 1, hay muchas instancias de \u201c#mbox-cells = menor que 0>;\u201d en el \u00e1rbol de dispositivos. Si ese es el caso y el controlador de mailbox correspondiente no proporciona punteros a las funciones \u201cfw_xlate\u201d y \u201cof_xlate\u201d, \u201cfw_mbox_index_xlate()\u201d se utilizar\u00e1 por defecto y podr\u00edan producirse accesos fuera de l\u00edmites debido a la falta de verificaci\u00f3n de l\u00edmites en esa funci\u00f3n."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF38EC6B-E140-4F00-8705-4F8DFC83958D", "versionEndExcluding": "6.1.167", "versionStartIncluding": "3.18.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C941823-DB24-432E-8F78-90665662756A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E909F0A0-2398-4420-AA63-605C42F5CADF"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77E4C479-2D2C-4009-8D71-18AF50454D7B"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5AE67DB-5E94-4439-98E9-761ACCC48A4A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "777DE673-1457-420F-AAAF-9B1E3AC79328"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "222D33AD-EC2D-4813-83C2-B904534BFCFE"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5F9AEA5-34CE-4ED3-9821-6C7435CE3320"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}