CyberSecBulletin
CVE-2026-43071NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-43071 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 45b06bb5ea96f75ad81d7ef446f832ea6b0026fe, 426ef05e82ee52c8d0e95fc0808b7383d8352d73, ddd57ebce245f9c7e2f6902a6c087d6186d2385d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.46% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 45b06bb5ea96f75ad81d7ef446f832ea6b0026fe or 426ef05e82ee52c8d0e95fc0808b7383d8352d73 or ddd57ebce245f9c7e2f6902a6c087d6186d2385d or 755b40903eff563768d4d96fd4ef51ec48adde3b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 3.11 or 3.13 or 3.15 or 3.17, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, 45b06bb5ea96f75ad81d7ef446f832ea6b0026fe; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, 426ef05e82ee52c8d0e95fc0808b7383d8352d73; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, ddd57ebce245f9c7e2f6902a6c087d6186d2385d; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, 755b40903eff563768d4d96fd4ef51ec48adde3b; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, 5718df131ab78897a9dd1f2e71c3ba732d4392af; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, 277cedabb0ab86baae83fa58218be13c6d3e5526; 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 up to, but not including, f08fe8891c3eeb63b73f9f1f6d97aa629c821579; d4c96061fddd129778ce8b70fb093aa532f422d0; and 8 more ranges45b06bb5ea96f75ad81d7ef446f832ea6b0026fe, 426ef05e82ee52c8d0e95fc0808b7383d8352d73, ddd57ebce245f9c7e2f6902a6c087d6186d2385d, 755b40903eff563768d4d96fd4ef51ec48adde3b, 5718df131ab78897a9dd1f2e71c3ba732d4392af, 277cedabb0ab86baae83fa58218be13c6d3e5526
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel3.10.55 up to, but not including, 3.11; 3.12.29 up to, but not including, 3.13; 3.14.19 up to, but not including, 3.15; 3.16.3 up to, but not including, 3.17; 3.17.1 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.136; 6.7 up to, but not including, 6.12.83; 6.13 up to, but not including, 6.18.24; and 3 more ranges3.11, 3.13, 3.15, 3.17, 6.1.175, 6.6.136

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP PTI RIP: 0010:__d_lookup+0x56/0x120 Call Trace: d_lookup.cold+0x16/0x5d lookup_dcache+0x27/0xf0 lookup_one_qstr_excl+0x2a/0x180 start_dirop+0x55/0xa0 simple_start_creating+0x8d/0xa0 debugfs_start_creating+0x8c/0x180 debugfs_create_dir+0x1d/0x1c0 pinctrl_init+0x6d/0x140 do_one_initcall+0x6d/0x3d0 kernel_init_freeable+0x39f/0x460 kernel_init+0x2a/0x260 There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable: d_lookup b = d_hash(hash) dentry_hashtable + ((u32)hashlen >> d_hash_shift) // The C standard defines the behavior of right shift amounts // exceeding the bit width of the operand as undefined. The // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen', // so 'b' will point to an unallocated memory region. hlist_bl_for_each_entry_rcu(b) hlist_bl_first_rcu(head) h->first // read OOB! Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.