Out-of-Bounds Write in Linux kernel (CVE-2026-43205, CVSS 7.8)

Summary

Out-of-bounds write in Linux kernel (CVE-2026-43205). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()
but never validates it against DPSW_MAX_IF (64). This value controls
iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices
into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports
num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port
num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all
ports match the flood filter, the loop fills all 64 slots and the control
interface write overflows by one entry.

The check uses >= because num_ifs == DPSW_MAX_IF is also functionally
broken.

build_if_id_bitmap() silently drops any ID >= 64:
if (id[i] < DPSW_MAX_IF)
bmap[id[i] / 64] |= ...

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

Linuxカーネルのdpaa2-switchドライバに関する脆弱性が修正されました。不正なファームウェア入力による境界を超えた書き込みを防ぐために、num_ifsの検証が追加されました。この脆弱性は、配列境界を超えてデータが書き込まれる可能性があるため、重要です。

❓ What is the problem

Linuxカーネルのdpaa2-switchドライバにおける境界外書き込み脆弱性

📍 Affected scope

dpaa2-switchドライバのdpaa2_switch_fdb_get_flood_cfg()関数

🔥 Severity

不正なファームウェア入力により境界外書き込みが発生する可能性があるため、重要

🔧 How to fix

dpaa2_switch_init()関数にnum_ifsの境界チェックを追加

🛡️ Workaround

なし

🔍 Detection

dpsw_get_attributes()が返すnum_ifs値がDPSW_MAX_IF未満であることを確認

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"5.13.0"},{"fixed":"5.15.202"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.165"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.128"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.75"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43205 linux-lts Fixed in: 6.1.167-r0
Debian DEBIAN-CVE-2026-43205 linux Fixed in: 6.1.170-1
Ubuntu UBUNTU-CVE-2026-43205 linux-hwe-edge

Out-of-Bounds Write in Linux kernel (CVE-2026-43205)

Summary

Original description

AI summary

Affected packages

Fix status by distribution

References