Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-43281 Details

Description

In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d kernel.orgPatch
https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f kernel.orgPatch
https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8 kernel.org
https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265 kernel.orgPatch
https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb kernel.orgPatch

see all 8 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-125Out-of-bounds Read[email protected]

Affected Products

ProductVersions
linux linux kernel
>= 3.18.1, < 6.1.167
>= 6.2, < 6.6.130
>= 6.7, < 6.12.77
>= 6.13, < 6.18.16
>= 6.19, < 6.19.6

CPE

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc5:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc6:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:3.18:rc7:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-43281
NVD Published Date:
May 6, 2026
NVD Last Modified:
Jun 17, 2026
Source:
kernel.org
CVE-2026-43281 Details - Not Deferred