CVE-2026-43281
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-06 12:16:49.587000
Last modified
2026-11-06 16:18:32.137000
View original CVE JSON
{
"id": "CVE-2026-43281",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-06T12:16:49.587",
"lastModified": "2026-11-06T16:18:32.137",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/mailbox/mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "2c7ff651ec6b660c7c96a36db9328b3232f555d8",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "ec0874447895b994182a962d2fee9ef075de5efd",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "2662ed331a69c0b551f78af58f12eb629a89a36f",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "31c4c67dec3362094a6747a171a4848e98542265",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "4caae8168d1b808c7d4ff481295292e3f97f90fb",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "f50b39fd7c72a8734153644ee945ca0d8b2e65ab",
"versionType": "git",
"status": "affected"
},
{
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"lessThan": "fcd7f96c783626c07ee3ed75fa3739a8a2052310",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/mailbox/mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.18",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.18",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.258",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.209",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.167",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.130",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.77",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.16",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.6",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T15:33:16.668371Z",
"id": "CVE-2026-43281",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.1",
"versionEndExcluding": "6.1.167",
"matchCriteriaId": "DF38EC6B-E140-4F00-8705-4F8DFC83958D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.130",
"matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.77",
"matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.16",
"matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.6",
"matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*",
"matchCriteriaId": "2C941823-DB24-432E-8F78-90665662756A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E909F0A0-2398-4420-AA63-605C42F5CADF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc3:*:*:*:*:*:*",
"matchCriteriaId": "77E4C479-2D2C-4009-8D71-18AF50454D7B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc4:*:*:*:*:*:*",
"matchCriteriaId": "C5AE67DB-5E94-4439-98E9-761ACCC48A4A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc5:*:*:*:*:*:*",
"matchCriteriaId": "777DE673-1457-420F-AAAF-9B1E3AC79328"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc6:*:*:*:*:*:*",
"matchCriteriaId": "222D33AD-EC2D-4813-83C2-B904534BFCFE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc7:*:*:*:*:*:*",
"matchCriteriaId": "A5F9AEA5-34CE-4ED3-9821-6C7435CE3320"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}