Vulnerability in linux (CVE-2026-43197, CVSS 9.1)

Summary

vulnerability in linux (CVE-2026-43197). Confidential information can be exposed externally.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

netconsole: avoid OOB reads, msg is not nul-terminated

msg passed to netconsole from the console subsystem is not guaranteed
to be nul-terminated. Before recent
commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure")
the message would be placed in printk_shared_pbufs, a static global
buffer, so KASAN had harder time catching OOB accesses. Now we see:

printk: console [netcon_ext0] enabled
BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240
Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594

CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9
Call Trace:
 kasan_report+0xe4/0x120
 string+0x1f7/0x240
 vsnprintf+0x655/0xba0
 scnprintf+0xba/0x120
 netconsole_write+0x3fe/0xa10
 nbcon_emit_next_record+0x46e/0x860
 nbcon_kthread_func+0x623/0x750

Allocated by task 1:
 nbcon_alloc+0x1ea/0x450
 register_console+0x26b/0xe10
 init_netconsole+0xbb0/0xda0

The buggy address belongs to the object at ffff88813b6d4000
            which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes to the right of
            allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability was found in the Linux kernel's netconsole. Attackers can exploit this without user interaction to steal information or disrupt system functionality. This unique bug can be mitigated by applying the latest security patches. Organizations should ensure that affected systems are patched to maintain security.

A vulnerability in the "netconsole" module of the Linux kernel allows for out-of-bounds reads due to non-null-terminated messages from the console subsystem. This was identified by a KASAN report showing slab-out-of-bounds in "string+0x1f7/0x240". Affected versions are unspecified but have been fixed in commit "3126a2f98beaec5a554a1fb31c46db1e8542665e". No specific workarounds are provided, and patching to the latest version is recommended. This vulnerability is critical because it allows remote exploitation without authentication or user interaction.

❓ What is the problem

Non-null-terminated messages in netconsole leading to out-of-bounds reads.

📍 Affected scope

Linux kernel's netconsole module.

🔥 Severity

Critical due to potential for information disclosure and system availability impact, exploitable remotely.

🔧 How to fix

Update to the latest kernel version including commit 3126a2f98beaec5a554a1fb31c46db1e8542665e.

🛡️ Workaround

No specific workaround available; apply latest patch.

🔍 Detection

Monitor for unusual string access patterns or KASAN reports related to netconsole.

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-0847

A vulnerability in Linux that allowed unauthorized access to kernel memory.

CVE-2020-14386

Another severe vulnerability in the Linux kernel that could be exploited remotely.

CVE-2021-26708

Linux kernel vulnerability also involving out-of-bounds access.

If this happens at your company Expected impact per business scenario

📌 In an enterprise server environment running multiple instances of Linux.

Unauthorized disclosure of sensitive data and potential service denial.

📌 In a cloud environment utilizing Linux-based containers.

Compromise of container integrity leading to data breaches.

📌 On critical infrastructure systems employing Linux for network management.

System outages and disruption of critical network services.

Recommended action

Apply the latest kernel updates to all affected systems and monitor for unusual console message activity.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43197 linux-lts
Debian DEBIAN-CVE-2026-43197 linux
Ubuntu UBUNTU-CVE-2026-43197 linux-hwe-edge

Vulnerability in linux (CVE-2026-43197)