CVE-2026-43274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43274", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:28:57.503Z", "dateUpdated": "2026-08-05T12:26:59.090Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:59.090Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()\n\nThe cluster_cfg array is dynamically allocated to hold per-CPU\nconfiguration structures, with its size based on the number of online\nCPUs. Previously, this array was indexed using hartid, which may be\nnon-contiguous or exceed the bounds of the array, leading to\nout-of-bounds access.\nSwitch to using cpuid as the index, as it is guaranteed to be within\nthe valid range provided by for_each_online_cpu()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through local platform-driver probe and the local Microchip IPC/IHC interrupt path, not through network packets. A plausible attacker would need local control of the affected platform/IPC peer or firmware configuration to trigger the bad hart/IRQ condition.\nAC:L - The bug is a direct non-contiguous hart ID versus CPU index mismatch with no race or timing requirement. Such hart mappings are plausible for this Microchip RISC-V platform, so triggering does not depend on conditions outside the attacker's control once the affected path is reachable.\nPR:N - The vulnerable probe and IRQ handler perform no Linux credential, capability, or authentication checks. An attacker able to drive the local IPC peer/firmware-triggered path does not need privileges inside the vulnerable Linux instance.\nUI:N - No victim action is required after the affected platform path is reachable. Probe-time setup or an IPC interrupt can hit the vulnerable access automatically.\nS:U - The corruption occurs in the Linux kernel driver and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary shown.\nC:H - The out-of-bounds index can read adjacent kernel memory/pointer fields and feed invalid buffer addresses into the SBI status path. Conservatively, this kernel OOB access can expose sensitive memory.\nI:H - The vulnerable probe path writes `irq`, `buf_base`, and `buf_base_addr` through an out-of-bounds `cluster_cfg[hartid]` index. This is kernel heap memory corruption and can plausibly be leveraged for control-flow or data integrity compromise.\nA:H - The same out-of-bounds access can corrupt kernel memory or dereference/copy through invalid pointers in interrupt context. A kernel oops, panic, or boot-time failure is a high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mailbox/mailbox-mchp-ipc-sbi.c"], "versions": [{"version": "e4b1d67e71419c4af581890ecea84b04920d4116", "lessThan": "95438699c92947155823dcd3918049a07f3cd867", "status": "affected", "versionType": "git"}, {"version": "e4b1d67e71419c4af581890ecea84b04920d4116", "lessThan": "0442b6229e2eedc95a6d3d18ce75dec7f5b5377c", "status": "affected", "versionType": "git"}, {"version": "e4b1d67e71419c4af581890ecea84b04920d4116", "lessThan": "f7c330a8c83c9b0332fd524097eaf3e69148164d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mailbox/mailbox-mchp-ipc-sbi.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/95438699c92947155823dcd3918049a07f3cd867"}, {"url": "https://git.kernel.org/stable/c/0442b6229e2eedc95a6d3d18ce75dec7f5b5377c"}, {"url": "https://git.kernel.org/stable/c/f7c330a8c83c9b0332fd524097eaf3e69148164d"}], "title": "mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mailbox/mailbox-mchp-ipc-sbi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "95438699c92947155823dcd3918049a07f3cd867", "status": "affected", "version": "e4b1d67e71419c4af581890ecea84b04920d4116", "versionType": "git"}, {"lessThan": "0442b6229e2eedc95a6d3d18ce75dec7f5b5377c", "status": "affected", "version": "e4b1d67e71419c4af581890ecea84b04920d4116", "versionType": "git"}, {"lessThan": "f7c330a8c83c9b0332fd524097eaf3e69148164d", "status": "affected", "version": "e4b1d67e71419c4af581890ecea84b04920d4116", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mailbox/mailbox-mchp-ipc-sbi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F818934F-3A6B-46F0-8626-9B45FC127C07", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()\n\nThe cluster_cfg array is dynamically allocated to hold per-CPU\nconfiguration structures, with its size based on the number of online\nCPUs. Previously, this array was indexed using hartid, which may be\nnon-contiguous or exceed the bounds of the array, leading to\nout-of-bounds access.\nSwitch to using cpuid as the index, as it is guaranteed to be within\nthe valid range provided by for_each_online_cpu()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmailbox: mchp-ipc-sbi: correcci\u00f3n de acceso fuera de l\u00edmites en mchp_ipc_get_cluster_aggr_irq()\n\nEl array cluster_cfg se asigna din\u00e1micamente para contener estructuras de configuraci\u00f3n por CPU, con su tama\u00f1o basado en el n\u00famero de CPUs en l\u00ednea. Anteriormente, este array se indexaba usando hartid, lo que puede ser no contiguo o exceder los l\u00edmites del array, llevando a un acceso fuera de l\u00edmites. Se cambia a usar cpuid como \u00edndice, ya que se garantiza que est\u00e1 dentro del rango v\u00e1lido proporcionado por for_each_online_cpu()."}], "id": "CVE-2026-43274", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T12:16:48.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0442b6229e2eedc95a6d3d18ce75dec7f5b5377c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/95438699c92947155823dcd3918049a07f3cd867"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7c330a8c83c9b0332fd524097eaf3e69148164d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()", "id": "2467241", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467241"}, "csaw": false, "cwe": "CWE-1285", "details": ["A flaw was found in the Linux kernel's mailbox subsystem, specifically within the mchp-ipc-sbi component. This vulnerability involves an out-of-bounds access in the `mchp_ipc_get_cluster_aggr_irq()` function. The `cluster_cfg` array, which holds per-CPU configuration structures, was incorrectly indexed using `hartid`, which could exceed the array's bounds. This issue can lead to memory corruption within the kernel."], "name": "CVE-2026-43274", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43274\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43274\nhttps://lore.kernel.org/linux-cve-announce/2026050611-CVE-2026-43274-7e15@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,95438699c92947155823dcd3918049a07f3cd867)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0442b6229e2eedc95a6d3d18ce75dec7f5b5377c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f7c330a8c83c9b0332fd524097eaf3e69148164d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:45:07.230362+00:00", "updated": "2026-05-08T21:00:10.216630+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}