CVE-2026-43316

{"id": "CVE-2026-43316", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "c327192ca26670cf6e588c1eeda66cd2fa97630e", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "0b3dadada2417782a63ce32dae05bafe1c949e3f", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "603e3859393ee2ce91393b7d05e6e56e4b66e5cd", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "33af366211ee78e3b074ff44a16121e537e86826", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "d29f33b2cf98e4901cd5457d1ee34062e808df73", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116", "versionType": "git"}, {"status": "affected", "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac", "lessThan": "0fdf6323c35a134f206dcad5babb4ff488552076", "versionType": "git"}], "programFiles": ["drivers/media/pci/solo6x10/solo6x10-tw28.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.36"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.36", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.252", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/pci/solo6x10/solo6x10-tw28.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:40.117", "references": [{"url": "https://git.kernel.org/stable/c/0b3dadada2417782a63ce32dae05bafe1c949e3f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/0fdf6323c35a134f206dcad5babb4ff488552076", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/33af366211ee78e3b074ff44a16121e537e86826", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/603e3859393ee2ce91393b7d05e6e56e4b66e5cd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c327192ca26670cf6e588c1eeda66cd2fa97630e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d29f33b2cf98e4901cd5457d1ee34062e808df73", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: solo6x10: Check for out of bounds chip_id\n\nClang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type\n(literal \"1\" is an \"int\") could end up being shifted beyond 32 bits,\nso instrumentation was added (and due to the double is_tw286x() call\nseen via inlining), Clang decides the second one must now be undefined\nbehavior and elides the rest of the function[1]. This is a known problem\nwith Clang (that is still being worked on), but we can avoid the entire\nproblem by actually checking the existing max chip ID, and now there is\nno runtime instrumentation added at all since everything is known to be\nwithin bounds.\n\nAdditionally use an unsigned value for the shift to remove the\ninstrumentation even without the explicit bounds checking.\n\n[hverkuil: fix checkpatch warning for is_tw286x]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: solo6x10: Comprobaci\u00f3n de chip_id fuera de l\u00edmites\n\nClang con CONFIG_UBSAN_SHIFT=y detect\u00f3 una condici\u00f3n donde un tipo con signo (el literal \u20191\u2019 es un \u2019int\u2019) podr\u00eda terminar siendo desplazado m\u00e1s all\u00e1 de 32 bits, por lo que se a\u00f1adi\u00f3 instrumentaci\u00f3n (y debido a la doble llamada a is_tw286x() vista a trav\u00e9s de la incrustaci\u00f3n), Clang decide que la segunda debe ser ahora un comportamiento indefinido y omite el resto de la funci\u00f3n[1]. Este es un problema conocido con Clang (que a\u00fan se est\u00e1 trabajando en ello), pero podemos evitar todo el problema comprobando realmente el ID m\u00e1ximo de chip existente, y ahora no se a\u00f1ade ninguna instrumentaci\u00f3n en tiempo de ejecuci\u00f3n ya que se sabe que todo est\u00e1 dentro de los l\u00edmites.\n\nAdem\u00e1s, usar un valor sin signo para el desplazamiento para eliminar la instrumentaci\u00f3n incluso sin la comprobaci\u00f3n expl\u00edcita de l\u00edmites.\n\n[hverkuil: corregir advertencia de checkpatch para is_tw286x]"}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6CED9D8-5F6B-4C90-A5E0-9FBEA1262F95", "versionEndExcluding": "5.10.252", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671", "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}