CVE-2026-43281: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-43281 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 40 · Related 40Timeline
- 06-05-2026PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.05 pp
From 0.12% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu157 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < 2c7ff651ec6b660c7c96a36db9328b3232f555d8 | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < ec0874447895b994182a962d2fee9ef075de5efd | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < 2662ed331a69c0b551f78af58f12eb629a89a36f | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < 31c4c67dec3362094a6747a171a4848e98542265 | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < 4caae8168d1b808c7d4ff481295292e3f97f90fb | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < f50b39fd7c72a8734153644ee945ca0d8b2e65ab | ≥ 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, < fcd7f96c783626c07ee3ed75fa3739a8a2052310 | 3.18
- linux_kernel≥ 3.18.1, < 6.1.167 | ≥ 6.2, < 6.6.130 | ≥ 6.7, < 6.12.77 | ≥ 6.13, < 6.18.16 | ≥ 6.19, < 6.19.6 | 3.18 | 3.18:rc2 | 3.18:rc3 | 3.18:rc4 | 3.18:rc5 | 3.18:rc6 | 3.18:rc7
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.6-1
3 vendors · 160 products
