CVE-2026-43272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:28:56.162Z", "dateUpdated": "2026-10-21T12:40:28.662Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:28.662Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix possible dereference of uninitialized pointer\n\nThere is a pointer head_page in rb_meta_validate_events() which is not\ninitialized at the beginning of a function. This pointer can be dereferenced\nif there is a failure during reader page validation. In this case the control\nis passed to \"invalid\" label where the pointer is dereferenced in a loop.\n\nTo fix the issue initialize orig_head and head_page before calling\nrb_validate_buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "lessThan": "a4afdff9c715af50cf6c3f2dc601932c2cea17a2", "status": "affected", "versionType": "git"}, {"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "lessThan": "bc77986f3cb7476637052edf2d87137fa39f153d", "status": "affected", "versionType": "git"}, {"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "lessThan": "d9942396845fef2369478c157b26738fe07142f6", "status": "affected", "versionType": "git"}, {"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "lessThan": "f1547779402c4cd67755c33616b7203baa88420b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4afdff9c715af50cf6c3f2dc601932c2cea17a2"}, {"url": "https://git.kernel.org/stable/c/bc77986f3cb7476637052edf2d87137fa39f153d"}, {"url": "https://git.kernel.org/stable/c/d9942396845fef2369478c157b26738fe07142f6"}, {"url": "https://git.kernel.org/stable/c/f1547779402c4cd67755c33616b7203baa88420b"}], "title": "ring-buffer: Fix possible dereference of uninitialized pointer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4afdff9c715af50cf6c3f2dc601932c2cea17a2", "status": "affected", "version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "versionType": "git"}, {"lessThan": "bc77986f3cb7476637052edf2d87137fa39f153d", "status": "affected", "version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "versionType": "git"}, {"lessThan": "d9942396845fef2369478c157b26738fe07142f6", "status": "affected", "version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "versionType": "git"}, {"lessThan": "f1547779402c4cd67755c33616b7203baa88420b", "status": "affected", "version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "932FBBB4-5FA7-4471-8493-E2DB77FEE8E8", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix possible dereference of uninitialized pointer\n\nThere is a pointer head_page in rb_meta_validate_events() which is not\ninitialized at the beginning of a function. This pointer can be dereferenced\nif there is a failure during reader page validation. In this case the control\nis passed to \"invalid\" label where the pointer is dereferenced in a loop.\n\nTo fix the issue initialize orig_head and head_page before calling\nrb_validate_buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nring-buffer: Correcci\u00f3n de posible desreferencia de puntero no inicializado\n\nHay un puntero head_page en rb_meta_validate_events() que no est\u00e1 inicializado al principio de una funci\u00f3n. Este puntero puede ser desreferenciado si hay un fallo durante la validaci\u00f3n de la p\u00e1gina del lector. En este caso, el control se pasa a la etiqueta \u2019invalid\u2019 donde el puntero es desreferenciado en un bucle.\n\nPara solucionar el problema, inicialice orig_head y head_page antes de llamar a rb_validate_buffer.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."}], "id": "CVE-2026-43272", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-06T12:16:48.433", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4afdff9c715af50cf6c3f2dc601932c2cea17a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bc77986f3cb7476637052edf2d87137fa39f153d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d9942396845fef2369478c157b26738fe07142f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1547779402c4cd67755c33616b7203baa88420b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ring-buffer: Fix possible dereference of uninitialized pointer", "id": "2467127", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467127"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's ring-buffer component. This vulnerability allows a local user to potentially cause a denial of service. The issue occurs because a pointer in the rb_meta_validate_events() function is not properly initialized, and its dereference during a reader page validation failure can lead to system instability or a crash."], "name": "CVE-2026-43272", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43272\nhttps://lore.kernel.org/linux-cve-announce/2026050611-CVE-2026-43272-da4b@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55,bc77986f3cb7476637052edf2d87137fa39f153d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55,d9942396845fef2369478c157b26738fe07142f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55,f1547779402c4cd67755c33616b7203baa88420b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.16,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.6,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T15:15:09.165018+00:00", "updated": "2026-05-08T21:45:19.000548+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}