CVE-2026-43071

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43071", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.982Z", "datePublished": "2026-05-05T15:29:28.081Z", "dateUpdated": "2026-11-10T12:46:30.050Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:44.632Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n'dhash_entries=1':\n BUG: unable to handle page fault for address: ffff888b30b774b0\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP PTI\n RIP: 0010:__d_lookup+0x56/0x120\n Call Trace:\n d_lookup.cold+0x16/0x5d\n lookup_dcache+0x27/0xf0\n lookup_one_qstr_excl+0x2a/0x180\n start_dirop+0x55/0xa0\n simple_start_creating+0x8d/0xa0\n debugfs_start_creating+0x8c/0x180\n debugfs_create_dir+0x1d/0x1c0\n pinctrl_init+0x6d/0x140\n do_one_initcall+0x6d/0x3d0\n kernel_init_freeable+0x39f/0x460\n kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n b = d_hash(hash)\n dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n // The C standard defines the behavior of right shift amounts\n // exceeding the bit width of the operand as undefined. The\n // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',\n // so 'b' will point to an unallocated memory region.\n hlist_bl_for_each_entry_rcu(b)\n hlist_bl_first_rcu(head)\n h->first // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that 'd_hash_shift' won't exceeds the bit width of type u32."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable dcache lookup is reachable through network-facing in-kernel file servers such as nfsd via an NFS LOOKUP request that reaches nfsd_lookup_dentry(), lookup_one_unlocked(), lookup_dcache(), d_lookup(), and __d_lookup(). A local syscall path also exists, but the network NFS path is the highest reasonable vector.\nAC:L - Once the kernel is booted with the vulnerable dhash_entries=1 setting, the out-of-bounds bucket calculation is deterministic and does not require winning a race or arranging timing. Attacker-controlled lookup names can repeatedly exercise the path.\nPR:N - In a plausible exported NFS deployment using AUTH_NULL or AUTH_SYS/default export security, a remote client can issue LOOKUP requests without holding privileges on the target host. The required vulnerable boot-time hash-table setting is a target configuration precondition, not an attacker privilege.\nUI:N - Exploitation does not require a victim user to open a file or perform any interactive action. A remote request or local lookup operation is sufficient once the vulnerable configuration is present.\nS:U - The flaw affects the kernel dcache and impacts the same kernel security authority that processes the lookup. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The bug is an out-of-bounds read from the dentry_hashtable, and the bucket index can point far outside the single allocated bucket. Following the kernel CVSS guidance, this unbounded kernel OOB read is treated as high confidentiality impact.\nI:N - The demonstrated primitive is an out-of-bounds read during hash bucket traversal, with no direct or reliable arbitrary write primitive shown by the fix or surrounding code. The primary demonstrated effect is invalid memory access rather than data modification.\nA:H - The patch report shows a kernel page fault and Oops in __d_lookup(), and the condition can be triggered repeatedly by lookup operations. Kernel oops/panic or failed boot is high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dcache.c"], "versions": [{"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "45b06bb5ea96f75ad81d7ef446f832ea6b0026fe", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "426ef05e82ee52c8d0e95fc0808b7383d8352d73", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "ddd57ebce245f9c7e2f6902a6c087d6186d2385d", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "755b40903eff563768d4d96fd4ef51ec48adde3b", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "5718df131ab78897a9dd1f2e71c3ba732d4392af", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "277cedabb0ab86baae83fa58218be13c6d3e5526", "status": "affected", "versionType": "git"}, {"version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "f08fe8891c3eeb63b73f9f1f6d97aa629c821579", "status": "affected", "versionType": "git"}, {"version": "d4c96061fddd129778ce8b70fb093aa532f422d0", "status": "affected", "versionType": "git"}, {"version": "be2378cbffe50ce0161f0fdee914adee98af53dc", "status": "affected", "versionType": "git"}, {"version": "a8be8af18485f9fade90e1743d940252a39eec84", "status": "affected", "versionType": "git"}, {"version": "b5cf3193759f7cd1cfbeef11f5cf067bbce22e55", "status": "affected", "versionType": "git"}, {"version": "3.10.55", "lessThan": "3.11", "status": "affected", "versionType": "semver"}, {"version": "3.12.29", "lessThan": "3.13", "status": "affected", "versionType": "semver"}, {"version": "3.14.19", "lessThan": "3.15", "status": "affected", "versionType": "semver"}, {"version": "3.16.3", "lessThan": "3.17", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dcache.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"}, {"url": "https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"}, {"url": "https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"}, {"url": "https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"}, {"url": "https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"}, {"url": "https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"}, {"url": "https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"}], "title": "dcache: Limit the minimal number of bucket to two", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:46:30.050Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:19.375972Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:12.548Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:46:30.050Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:19.375972Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:14:20.057Z"}}], "cna": {"title": "dcache: Limit the minimal number of bucket to two", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable dcache lookup is reachable through network-facing in-kernel file servers such as nfsd via an NFS LOOKUP request that reaches nfsd_lookup_dentry(), lookup_one_unlocked(), lookup_dcache(), d_lookup(), and __d_lookup(). A local syscall path also exists, but the network NFS path is the highest reasonable vector.\nAC:L - Once the kernel is booted with the vulnerable dhash_entries=1 setting, the out-of-bounds bucket calculation is deterministic and does not require winning a race or arranging timing. Attacker-controlled lookup names can repeatedly exercise the path.\nPR:N - In a plausible exported NFS deployment using AUTH_NULL or AUTH_SYS/default export security, a remote client can issue LOOKUP requests without holding privileges on the target host. The required vulnerable boot-time hash-table setting is a target configuration precondition, not an attacker privilege.\nUI:N - Exploitation does not require a victim user to open a file or perform any interactive action. A remote request or local lookup operation is sufficient once the vulnerable configuration is present.\nS:U - The flaw affects the kernel dcache and impacts the same kernel security authority that processes the lookup. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The bug is an out-of-bounds read from the dentry_hashtable, and the bucket index can point far outside the single allocated bucket. Following the kernel CVSS guidance, this unbounded kernel OOB read is treated as high confidentiality impact.\nI:N - The demonstrated primitive is an out-of-bounds read during hash bucket traversal, with no direct or reliable arbitrary write primitive shown by the fix or surrounding code. The primary demonstrated effect is invalid memory access rather than data modification.\nA:H - The patch report shows a kernel page fault and Oops in __d_lookup(), and the condition can be triggered repeatedly by lookup operations. Kernel oops/panic or failed boot is high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "45b06bb5ea96f75ad81d7ef446f832ea6b0026fe", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "426ef05e82ee52c8d0e95fc0808b7383d8352d73", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "ddd57ebce245f9c7e2f6902a6c087d6186d2385d", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "755b40903eff563768d4d96fd4ef51ec48adde3b", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "5718df131ab78897a9dd1f2e71c3ba732d4392af", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "277cedabb0ab86baae83fa58218be13c6d3e5526", "versionType": "git"}, {"status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "lessThan": "f08fe8891c3eeb63b73f9f1f6d97aa629c821579", "versionType": "git"}, {"status": "affected", "version": "d4c96061fddd129778ce8b70fb093aa532f422d0", "versionType": "git"}, {"status": "affected", "version": "be2378cbffe50ce0161f0fdee914adee98af53dc", "versionType": "git"}, {"status": "affected", "version": "a8be8af18485f9fade90e1743d940252a39eec84", "versionType": "git"}, {"status": "affected", "version": "b5cf3193759f7cd1cfbeef11f5cf067bbce22e55", "versionType": "git"}, {"status": "affected", "version": "3.10.55", "lessThan": "3.11", "versionType": "semver"}, {"status": "affected", "version": "3.12.29", "lessThan": "3.13", "versionType": "semver"}, {"status": "affected", "version": "3.14.19", "lessThan": "3.15", "versionType": "semver"}, {"status": "affected", "version": "3.16.3", "lessThan": "3.17", "versionType": "semver"}], "programFiles": ["fs/dcache.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"status": "unaffected", "version": "0", "lessThan": "3.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/dcache.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"}, {"url": "https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"}, {"url": "https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"}, {"url": "https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"}, {"url": "https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"}, {"url": "https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"}, {"url": "https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n'dhash_entries=1':\n BUG: unable to handle page fault for address: ffff888b30b774b0\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP PTI\n RIP: 0010:__d_lookup+0x56/0x120\n Call Trace:\n d_lookup.cold+0x16/0x5d\n lookup_dcache+0x27/0xf0\n lookup_one_qstr_excl+0x2a/0x180\n start_dirop+0x55/0xa0\n simple_start_creating+0x8d/0xa0\n debugfs_start_creating+0x8c/0x180\n debugfs_create_dir+0x1d/0x1c0\n pinctrl_init+0x6d/0x140\n do_one_initcall+0x6d/0x3d0\n kernel_init_freeable+0x39f/0x460\n kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n b = d_hash(hash)\n dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n // The C standard defines the behavior of right shift amounts\n // exceeding the bit width of the operand as undefined. The\n // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',\n // so 'b' will point to an unallocated memory region.\n hlist_bl_for_each_entry_rcu(b)\n hlist_bl_first_rcu(head)\n h->first // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that 'd_hash_shift' won't exceeds the bit width of type u32."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.1", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.10.55"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.12.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.14.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.16.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:44.632Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43071", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:46:30.050Z", "dateReserved": "2026-05-01T14:12:55.982Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-05T15:29:28.081Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/dcache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "45b06bb5ea96f75ad81d7ef446f832ea6b0026fe", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "426ef05e82ee52c8d0e95fc0808b7383d8352d73", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "ddd57ebce245f9c7e2f6902a6c087d6186d2385d", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "755b40903eff563768d4d96fd4ef51ec48adde3b", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "5718df131ab78897a9dd1f2e71c3ba732d4392af", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "277cedabb0ab86baae83fa58218be13c6d3e5526", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"lessThan": "f08fe8891c3eeb63b73f9f1f6d97aa629c821579", "status": "affected", "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6", "versionType": "git"}, {"status": "affected", "version": "d4c96061fddd129778ce8b70fb093aa532f422d0", "versionType": "git"}, {"status": "affected", "version": "be2378cbffe50ce0161f0fdee914adee98af53dc", "versionType": "git"}, {"status": "affected", "version": "a8be8af18485f9fade90e1743d940252a39eec84", "versionType": "git"}, {"status": "affected", "version": "b5cf3193759f7cd1cfbeef11f5cf067bbce22e55", "versionType": "git"}, {"lessThan": "3.11", "status": "affected", "version": "3.10.55", "versionType": "semver"}, {"lessThan": "3.13", "status": "affected", "version": "3.12.29", "versionType": "semver"}, {"lessThan": "3.15", "status": "affected", "version": "3.14.19", "versionType": "semver"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/dcache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A516330-2A83-4603-8C0E-BBDFEECC27E9", "versionEndExcluding": "3.11", "versionStartIncluding": "3.10.55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "25875AFE-CAEF-4D99-9B64-23F2B24C08D0", "versionEndExcluding": "3.13", "versionStartIncluding": "3.12.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D53296D-7B6A-4B74-A72C-45082E6C8531", "versionEndExcluding": "3.15", "versionStartIncluding": "3.14.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F14E1ED6-C14D-476A-BC5C-ED4B577D6D9D", "versionEndExcluding": "3.17", "versionStartIncluding": "3.16.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EBFC0E0-CAF5-4E1E-9563-49D5637FEB2F", "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A0F1E9A-F127-4699-A014-9E08441C9A14", "versionEndExcluding": "6.6.136", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*", "matchCriteriaId": "3A351B03-87A0-405B-8A9B-488E173E1E3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "4223286C-F679-4FEC-B144-1C3B942BD506", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*", "matchCriteriaId": "C889AAA8-186E-433F-A31D-FF09221E1EBC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*", "matchCriteriaId": "80BC78EE-50D8-4561-A6A6-A370E72F215B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n'dhash_entries=1':\n BUG: unable to handle page fault for address: ffff888b30b774b0\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP PTI\n RIP: 0010:__d_lookup+0x56/0x120\n Call Trace:\n d_lookup.cold+0x16/0x5d\n lookup_dcache+0x27/0xf0\n lookup_one_qstr_excl+0x2a/0x180\n start_dirop+0x55/0xa0\n simple_start_creating+0x8d/0xa0\n debugfs_start_creating+0x8c/0x180\n debugfs_create_dir+0x1d/0x1c0\n pinctrl_init+0x6d/0x140\n do_one_initcall+0x6d/0x3d0\n kernel_init_freeable+0x39f/0x460\n kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n b = d_hash(hash)\n dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n // The C standard defines the behavior of right shift amounts\n // exceeding the bit width of the operand as undefined. The\n // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',\n // so 'b' will point to an unallocated memory region.\n hlist_bl_for_each_entry_rcu(b)\n hlist_bl_first_rcu(head)\n h->first // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that 'd_hash_shift' won't exceeds the bit width of type u32."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndcache: Limitar el n\u00famero m\u00ednimo de cubos a dos\n\nExiste un problema de lectura OOB en dentry_hashtable cuando el usuario establece \u2019dhash_entries=1\u2019:\n BUG: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffff888b30b774b0\n #PF: acceso de lectura de supervisor en modo kernel\n #PF: error_code(0x 0000) - p\u00e1gina no presente\n Oops: Oops: 0000 [#1] SMP PTI\n RIP: 0010:__d_lookup+0x56/0x120\n Rastro de llamada:\n d_lookup.cold+0x16/0x5d\n lookup_dcache+0x27/0xf0\n lookup_one_qstr_excl+0x2a/0x180\n start_dirop+0x55/0xa0\n simple_start_creating+0x8d/0xa0\n debugfs_start_creating+0x8c/0x180\n debugfs_create_dir+0x1d/0x1c0\n pinctrl_init+0x6d/0x140\n do_one_initcall+0x6d/0x3d0\n kernel_init_freeable+0x39f/0x460\n kernel_init+0x2a/0x260\n\nHabr\u00e1 solo un cubo en dentry_hashtable cuando dhash_entries se establece como uno, y d_hash_shift se calcula como 32 por dcache_init(). Entonces, el siguiente proceso acceder\u00e1 a m\u00e1s de un cubo (cuya regi\u00f3n de memoria no est\u00e1 asignada) en dentry_hashtable:\n d_lookup\n b = d_hash(hash)\n dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n // El est\u00e1ndar C define el comportamiento de los desplazamientos a la derecha\n // que exceden el ancho de bits del operando como indefinido. El\n // resultado de \u2019(u32)hashlen >> d_hash_shift\u2019 se convierte en \u2019hashlen\u2019,\n // por lo que \u2019b\u2019 apuntar\u00e1 a una regi\u00f3n de memoria no asignada.\n hlist_bl_for_each_entry_rcu(b)\n hlist_bl_first_rcu(head)\n h -> first // \u00a1lectura OOB!\n\nCorregirlo limitando el n\u00famero m\u00ednimo de cubos de dentry_hashtable a dos, para que \u2019d_hash_shift\u2019 no exceda el ancho de bits del tipo u32."}], "evaluatorComment": "\n", "id": "CVE-2026-43071", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43071", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:19.375972Z", "version": "2.0.3"}}]}, "published": "2026-05-05T16:16:16.420", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: dcache: Limit the minimal number of bucket to two", "id": "2466774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466774"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-823", "details": ["A flaw was found in the Linux kernel's dcache component. When the 'dhash_entries' parameter is set to one, an out-of-bounds (OOB) read occurs in the dentry_hashtable. This issue arises due to an incorrect calculation of the 'd_hash_shift' value, causing the system to attempt to access unallocated memory. A local attacker could exploit this vulnerability to trigger a kernel panic, leading to a denial of service (DoS)."], "name": "CVE-2026-43071", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43071\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43071\nhttps://lore.kernel.org/linux-cve-announce/2026050557-CVE-2026-43071-9e21@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,426ef05e82ee52c8d0e95fc0808b7383d8352d73)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ddd57ebce245f9c7e2f6902a6c087d6186d2385d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,755b40903eff563768d4d96fd4ef51ec48adde3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5718df131ab78897a9dd1f2e71c3ba732d4392af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,277cedabb0ab86baae83fa58218be13c6d3e5526)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f08fe8891c3eeb63b73f9f1f6d97aa629c821579)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-05T18:15:29.752998+00:00", "updated": "2026-05-29T20:00:05.735621+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}