CVE-2026-43075

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43075", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.982Z", "datePublished": "2026-05-06T07:40:03.337Z", "dateUpdated": "2026-08-05T12:25:46.787Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:46.787Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device. The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free. The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data. On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n vfs_copy_file_range (fs/read_write.c:1634)\n do_splice_direct\n splice_direct_to_actor\n iter_file_splice_write\n ocfs2_file_write_iter\n generic_perform_write\n ocfs2_write_end\n ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n memcpy_from_folio <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable OCFS2 inline write path is reached through local VFS operations such as write/copy_file_range on an OCFS2 file, not by packets or physical device parsing directly.\nAC:L - Once a malformed inline-data inode with an excessive id_count is present, triggering the overflow is deterministic through ordinary writes and does not require winning a race or relying on conditions outside attacker control.\nPR:L - The write path itself has no OCFS2-specific privileged gate beyond normal file write permission, so a local user able to write the affected mounted file can trigger it. OCFS2 is not userns-mountable and crafting/mounting the corrupted image normally needs admin rights, but the highest reasonable shared-mounted-filesystem trigger requires only low local privileges.\nUI:N - After the affected OCFS2 filesystem is mounted, exploitation is triggered by the attacker's own file operation and does not require another user to act.\nS:U - The corruption occurs within kernel filesystem/buffer-cache memory and does not cross a separate security authority such as a guest/host or IOMMU boundary.\nC:H - This is attacker-controlled out-of-bounds kernel memory corruption, which can reasonably be leveraged into disclosure primitives rather than only a visible crash.\nI:H - The bug performs an out-of-bounds write from attacker-controlled file data past the inode block buffer, making high-integrity impact appropriate.\nA:H - The reported KASAN crash and the underlying kernel memory corruption can oops or panic the kernel, producing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/inode.c"], "versions": [{"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "22df7d4de9c5cd42edf855a1de25f2106088c4c6", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "e2c9dc6b6e96f3585f2a1062ca3374a52db0938f", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "947f953978b0d9463498d548d0f054f5a75be2e9", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "0c1af902223b6fcedb60904ca0b551254686c7b9", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "69d3c69ade1e4285ab4ca48fe7acee0767e65604", "status": "affected", "versionType": "git"}, {"version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "lessThan": "7bc5da4842bed3252d26e742213741a4d0ac1b14", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/inode.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea"}, {"url": "https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e"}, {"url": "https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6"}, {"url": "https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f"}, {"url": "https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9"}, {"url": "https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9"}, {"url": "https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604"}, {"url": "https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14"}], "title": "ocfs2: fix out-of-bounds write in ocfs2_write_end_inline", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "22df7d4de9c5cd42edf855a1de25f2106088c4c6", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "e2c9dc6b6e96f3585f2a1062ca3374a52db0938f", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "947f953978b0d9463498d548d0f054f5a75be2e9", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "0c1af902223b6fcedb60904ca0b551254686c7b9", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "69d3c69ade1e4285ab4ca48fe7acee0767e65604", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}, {"lessThan": "7bc5da4842bed3252d26e742213741a4d0ac1b14", "status": "affected", "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C45350C-5A79-40F0-B6B0-BF9ED7FA81B4", "versionEndExcluding": "6.6.136", "versionStartIncluding": "2.6.24.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.24:-:*:*:*:*:*:*", "matchCriteriaId": "6F3E61F3-1CF1-4176-94CD-89A408BCFC96", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device. The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free. The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data. On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n vfs_copy_file_range (fs/read_write.c:1634)\n do_splice_direct\n splice_direct_to_actor\n iter_file_splice_write\n ocfs2_file_write_iter\n generic_perform_write\n ocfs2_write_end\n ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n memcpy_from_folio <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocfs2: correcci\u00f3n de escritura fuera de l\u00edmites en ocfs2_write_end_inline\n\nKASAN informa una escritura de uso despu\u00e9s de liberaci\u00f3n de 4086 bytes en ocfs2_write_end_inline, llamada desde ocfs2_write_end_nolock durante un fallback de splice de copy_file_range en un sistema de archivos ocfs2 corrupto montado en un dispositivo de bucle. El error real es una escritura fuera de l\u00edmites m\u00e1s all\u00e1 del b\u00fafer del bloque de inodo, no un verdadero uso despu\u00e9s de liberaci\u00f3n. La escritura desborda en una p\u00e1gina adyacente liberada, que KASAN informa como UAF.\n\nLa causa ra\u00edz es que ocfs2_try_to_write_inline_data conf\u00eda en el campo id_count en disco para determinar si una escritura cabe en los datos en l\u00ednea. En un sistema de archivos corrupto, id_count puede exceder la capacidad m\u00e1xima f\u00edsica de datos en l\u00ednea, causando que las escrituras desborden el b\u00fafer del bloque de inodo.\n\nRuta de llamada (ruta de fallo):\n\n vfs_copy_file_range (fs/read_write.c:1634)\n do_splice_direct\n splice_direct_to_actor\n iter_file_splice_write\n ocfs2_file_write_iter\n generic_perform_write\n ocfs2_write_end\n ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n memcpy_from_folio <- - KASAN: escritura OOB\n\nPor lo tanto, se a\u00f1ade una comprobaci\u00f3n de l\u00edmite superior de id_count en ocfs2_validate_inode_block() junto con la comprobaci\u00f3n existente de i_size para solucionarlo."}], "id": "CVE-2026-43075", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T10:16:20.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline", "id": "2466979", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466979"}, "csaw": false, "cwe": "CWE-1284", "details": ["A flaw was found in the Linux kernel's ocfs2 filesystem component. This vulnerability allows a local attacker, by mounting a specially crafted and corrupted ocfs2 filesystem on a loop device, to trigger an out-of-bounds write. This occurs because the system incorrectly trusts the `id_count` field from the on-disk filesystem, which can lead to memory corruption. The most significant consequence is potential system instability or denial of service."], "name": "CVE-2026-43075", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43075\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43075\nhttps://lore.kernel.org/linux-cve-announce/2026050610-CVE-2026-43075-7e04@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e2c9dc6b6e96f3585f2a1062ca3374a52db0938f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,947f953978b0d9463498d548d0f054f5a75be2e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0c1af902223b6fcedb60904ca0b551254686c7b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,69d3c69ade1e4285ab4ca48fe7acee0767e65604)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7bc5da4842bed3252d26e742213741a4d0ac1b14)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T11:30:26.608804+00:00", "updated": "2026-05-21T00:30:43.588443+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}