{"id":"CVE-2026-43281","title":"mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2c7ff651ec6b660c7c96a36db9328b3232f555d8","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < ec0874447895b994182a962d2fee9ef075de5efd","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2662ed331a69c0b551f78af58f12eb629a89a36f","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 31c4c67dec3362094a6747a171a4848e98542265","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 4caae8168d1b808c7d4ff481295292e3f97f90fb","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < f50b39fd7c72a8734153644ee945ca0d8b2e65ab","Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < fcd7f96c783626c07ee3ed75fa3739a8a2052310","Linux 3.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:33:16.668371Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:46.580Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43281","references":[{"url":"https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8"},{"url":"https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd"},{"url":"https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f"},{"url":"https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265"},{"url":"https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d"},{"url":"https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb"},{"url":"https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab"},{"url":"https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310"}],"tags":["cve.org"],"epss":0.00119,"epssPercentile":0.01803,"ingestedAt":"2026-11-06T15:54:03.950Z","slug":"CVE-2026-43281","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.\n\n## Affected\n\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2c7ff651ec6b660c7c96a36db9328b3232f555d8`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < ec0874447895b994182a962d2fee9ef075de5efd`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2662ed331a69c0b551f78af58f12eb629a89a36f`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 31c4c67dec3362094a6747a171a4848e98542265`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 4caae8168d1b808c7d4ff481295292e3f97f90fb`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < f50b39fd7c72a8734153644ee945ca0d8b2e65ab`\n- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < fcd7f96c783626c07ee3ed75fa3739a8a2052310`\n- `Linux 3.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}