---
id: CVE-2026-43281
title: 'mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

  Although it is guided that `#mbox-cells` must be at least 1, there are
  many instances of `#mbox-cells = …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    2c7ff651ec6b660c7c96a36db9328b3232f555d8
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    ec0874447895b994182a962d2fee9ef075de5efd
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    2662ed331a69c0b551f78af58f12eb629a89a36f
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    31c4c67dec3362094a6747a171a4848e98542265
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    4caae8168d1b808c7d4ff481295292e3f97f90fb
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    f50b39fd7c72a8734153644ee945ca0d8b2e65ab
  - >-
    Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c <
    fcd7f96c783626c07ee3ed75fa3739a8a2052310
  - Linux 3.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:33:16.668371Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:46.580Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43281'
references:
  - url: 'https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8'
  - url: 'https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd'
  - url: 'https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f'
  - url: 'https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265'
  - url: 'https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d'
  - url: 'https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb'
  - url: 'https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab'
  - url: 'https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01803
ingestedAt: '2026-11-06T15:54:03.950Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Although it is guided that `#mbox-cells` must be at least 1, there are
many instances of `#mbox-cells = <0>;` in the device tree. If that is
the case and the corresponding mailbox controller does not provide
`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will
be used by default and out-of-bounds accesses could occur due to lack of
bounds check in that function.

## Affected

- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2c7ff651ec6b660c7c96a36db9328b3232f555d8`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < ec0874447895b994182a962d2fee9ef075de5efd`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 2662ed331a69c0b551f78af58f12eb629a89a36f`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 31c4c67dec3362094a6747a171a4848e98542265`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < 4caae8168d1b808c7d4ff481295292e3f97f90fb`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < f50b39fd7c72a8734153644ee945ca0d8b2e65ab`
- `Linux >= 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c < fcd7f96c783626c07ee3ed75fa3739a8a2052310`
- `Linux 3.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.