Vulnerability in c (CVE-2026-43071, CVSS 9.1)

Summary

vulnerability in c (CVE-2026-43071). Confidential information can be exposed externally.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

dcache: Limit the minimal number of bucket to two

There is an OOB read problem on dentry_hashtable when user sets
'dhash_entries=1':
BUG: unable to handle page fault for address: ffff888b30b774b0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP PTI
RIP: 0010:__d_lookup+0x56/0x120
Call Trace:
d_lookup.cold+0x16/0x5d
lookup_dcache+0x27/0xf0
lookup_one_qstr_excl+0x2a/0x180
start_dirop+0x55/0xa0
simple_start_creating+0x8d/0xa0
debugfs_start_creating+0x8c/0x180
debugfs_create_dir+0x1d/0x1c0
pinctrl_init+0x6d/0x140
do_one_initcall+0x6d/0x3d0
kernel_init_freeable+0x39f/0x460
kernel_init+0x2a/0x260

There will be only one bucket in dentry_hashtable when dhash_entries is
set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,
following process will access more than one buckets(which memory region
is not allocated) in dentry_hashtable:
d_lookup
b = d_hash(hash)
dentry_hashtable + ((u32)hashlen >> d_hash_shift)
// The C standard defines the behavior of right shift amounts
// exceeding the bit width of the operand as undefined. The
// result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',
// so 'b' will point to an unallocated memory region.
hlist_bl_for_each_entry_rcu(b)
hlist_bl_first_rcu(head)
h->first // read OOB!

Fix it by limiting the minim…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

In the Linux kernel, a specific setting (dhash_entries=1) could lead to improper memory access, potentially allowing unauthorized access or disabling systems. Fixes involve limiting buckets to ensure security. This issue has occurred in the past, and applying the latest patches is crucial. System administrators should urgently apply these updates to secure their systems.

A vulnerability related to the dentry_hashtable in dcache can lead to out-of-bounds memory access if dhash_entries=1 is configured, pointing to unallocated memory. The issue is resolved by setting a minimum of two buckets for dhash_entries. The affected version range is unspecified, and fixes involve updating the source. Detecting unpatched systems might be difficult; administrators should ensure configuration changes are applied to mitigate risks.

❓ What is the problem

A vulnerability in the Linux kernel's dentry_hashtable when dhash_entries=1, causing out-of-bounds memory access.

📍 Affected scope

Linux kernel, specifically in dcache related to dentry_hashtable.

🔥 Severity

Critical impact due to the potential for remote exploitation without required privileges or user interaction. CVSS 9.1.

🔧 How to fix

Adjust dhash_entries to ensure a minimum of two buckets in dentry_hashtable.

🛡️ Workaround

No specific workaround available; ensure the dhash_entries configuration is set correctly.

🔍 Detection

The vulnerability is configuration-sensitive; general detection is challenging without specific configuration checks.

Related past incidents Similar incidents extracted from past CVEs

Heartbleed

A similar type of vulnerability exploiting memory access issues leading to data leaks.

If this happens at your company Expected impact per business scenario

📌 データセンターにあるLinuxサーバーが影響する場合

不正アクセスによるデータ漏洩やサービスダウンにつながる可能性が高い。

📌 Linux OSが基盤となっているECサイトで脆弱性の存在が公表された場合

顧客データが漏洩し、ブランドイメージに重大な影響を及ぼす。

📌 社内ITシステムでLinuxを広く利用している場合

システム停止や情報漏洩により業務運営に深刻な支障が生じる。

Recommended action

企業として、Linuxサーバーの設定を見直し、パッチを当てることを推奨。システムの継続的な監査と、セキュリティパッチ適用の迅速化が求められます。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'c' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で c を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.136"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.83"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.24"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0"},{"fixed":"7.0.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43071 linux-lts Fixed in: 6.1.175-r0
Debian DEBIAN-CVE-2026-43071 linux
Ubuntu UBUNTU-CVE-2026-43071 linux

Vulnerability in c (CVE-2026-43071)