Linux: Out-of-bounds Read
CVE-2026-43025 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.3 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e135f8e8212cbed12a03ab8dec77fa1247139897, 2ea0f35f235f70c133ad61fe05ba013753b978c6, 0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to e135f8e8212cbed12a03ab8dec77fa1247139897 or 2ea0f35f235f70c133ad61fe05ba013753b978c6 or 0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd or 187b6ec5229ea93cb04c4f6d3b52efc80f513d0d, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.168 or 6.6.134 or 6.12.81 or 6.18.22, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, e135f8e8212cbed12a03ab8dec77fa1247139897; bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, 2ea0f35f235f70c133ad61fe05ba013753b978c6; bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, 0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd; bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, 187b6ec5229ea93cb04c4f6d3b52efc80f513d0d; bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, 21a04c31db4057deec85fcd6cc63d720b38819c3; bd0779370588386e4a67ba5d0b176cfded8e6a53 up to, but not including, 917b61fa2042f11e2af4c428e43f08199586633a; 3.12 | e135f8e8212cbed12a03ab8dec77fa1247139897, 2ea0f35f235f70c133ad61fe05ba013753b978c6, 0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd, 187b6ec5229ea93cb04c4f6d3b52efc80f513d0d, 21a04c31db4057deec85fcd6cc63d720b38819c3, 917b61fa2042f11e2af4c428e43f08199586633a |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 3.12 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 7.0 | 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- LowLimited modification of data is possible.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation. This was uncovered when validating CTA_EXPECT_CLASS via different helper provided by userspace than the existing master conntrack helper: BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nf_ct_expect_related_report+0x2479/0x27c0 ctnetlink_create_expect+0x22b/0x3b0 ctnetlink_new_expect+0x4bd/0x5c0 nfnetlink_rcv_msg+0x67a/0x950 netlink_rcv_skb+0x120/0x350 Allowing to read kernel memory bytes off the expectation boundary. CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace via netlink dump.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd
- git.kernel.org/stable/c/187b6ec5229ea93cb04c4f6d3b52efc80f513d0d
- git.kernel.org/stable/c/21a04c31db4057deec85fcd6cc63d720b38819c3
- git.kernel.org/stable/c/2ea0f35f235f70c133ad61fe05ba013753b978c6
- git.kernel.org/stable/c/917b61fa2042f11e2af4c428e43f08199586633a
- git.kernel.org/stable/c/e135f8e8212cbed12a03ab8dec77fa1247139897
Other references
Recent Out-of-bounds Read vulnerabilities
- 8.1 High severity
- 8.8 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.