CyberSecBulletin
CVE-2026-43083NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-43083 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc, a05a85779c2574b6534abb8cdc6d65fbc2e91208, f1af9d19503b73011dae5051c354fd39b03e240d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.6% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc or a05a85779c2574b6534abb8cdc6d65fbc2e91208 or f1af9d19503b73011dae5051c354fd39b03e240d or 6d1d9ed9b409e0662241e3d245d574a18f643494, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.18.24 or 6.19.14, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc; b63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, a05a85779c2574b6534abb8cdc6d65fbc2e91208; b63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, f1af9d19503b73011dae5051c354fd39b03e240d; b63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, 6d1d9ed9b409e0662241e3d245d574a18f643494; b63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, 95a1334748c95dd15546056280ade0c4b8dd7b78; b63c5478e9cb1d1504eb02d9dac827ad24612b32 up to, but not including, b30b1675aa2bcf0491fd3830b051df4e08a7c8ca; 5.17d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc, a05a85779c2574b6534abb8cdc6d65fbc2e91208, f1af9d19503b73011dae5051c354fd39b03e240d, 6d1d9ed9b409e0662241e3d245d574a18f643494, 95a1334748c95dd15546056280ade0c4b8dd7b78, b30b1675aa2bcf0491fd3830b051df4e08a7c8ca
LinuxLinux Kernel5.17 up to, but not including, 6.18.24; 6.19 up to, but not including, 6.19.14; 7.06.18.24, 6.19.14

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.