CyberSecBulletin
CVE-2026-43406NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-43406 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 76ccf21a12c5f6d6790bc32c7da82446d877b2f4, 75582aaa580c11aed4c7731cad6b068b700e7efb, 50156622eb0888e62541d715a98584480a1bc7cb as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.61% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 76ccf21a12c5f6d6790bc32c7da82446d877b2f4 or 75582aaa580c11aed4c7731cad6b068b700e7efb or 50156622eb0888e62541d715a98584480a1bc7cb or dbd857a9e1e33ea71eaf3e211877027e533770d1, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.78, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxcd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 76ccf21a12c5f6d6790bc32c7da82446d877b2f4; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 75582aaa580c11aed4c7731cad6b068b700e7efb; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 50156622eb0888e62541d715a98584480a1bc7cb; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, dbd857a9e1e33ea71eaf3e211877027e533770d1; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 69fe5af33fa3806f398d21c081d73c66e5523bc2; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 69fb5d91bba44ecf7eb80530b85fa4fb028921d5; 5.1176ccf21a12c5f6d6790bc32c7da82446d877b2f4, 75582aaa580c11aed4c7731cad6b068b700e7efb, 50156622eb0888e62541d715a98584480a1bc7cb, dbd857a9e1e33ea71eaf3e211877027e533770d1, 69fe5af33fa3806f398d21c081d73c66e5523bc2, 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8
LinuxLinux Kernel5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.19; 6.19 up to, but not including, 6.19.9; 7.05.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in process_message_header(). Perform an explicit bounds check before decoding the message header.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.