CVE-2026-43274 (GCVE-0-2026-43274)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
Title
mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()
Summary
In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, this array was indexed using hartid, which may be non-contiguous or exceed the bounds of the array, leading to out-of-bounds access. Switch to using cpuid as the index, as it is guaranteed to be within the valid range provided by for_each_online_cpu().
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e4b1d67e71419c4af581890ecea84b04920d4116 , < 95438699c92947155823dcd3918049a07f3cd867 (git)
Affected: e4b1d67e71419c4af581890ecea84b04920d4116 , < 0442b6229e2eedc95a6d3d18ce75dec7f5b5377c (git)
Affected: e4b1d67e71419c4af581890ecea84b04920d4116 , < f7c330a8c83c9b0332fd524097eaf3e69148164d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mailbox-mchp-ipc-sbi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95438699c92947155823dcd3918049a07f3cd867",
              "status": "affected",
              "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
              "versionType": "git"
            },
            {
              "lessThan": "0442b6229e2eedc95a6d3d18ce75dec7f5b5377c",
              "status": "affected",
              "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
              "versionType": "git"
            },
            {
              "lessThan": "f7c330a8c83c9b0332fd524097eaf3e69148164d",
              "status": "affected",
              "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mailbox-mchp-ipc-sbi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()\n\nThe cluster_cfg array is dynamically allocated to hold per-CPU\nconfiguration structures, with its size based on the number of online\nCPUs. Previously, this array was indexed using hartid, which may be\nnon-contiguous or exceed the bounds of the array, leading to\nout-of-bounds access.\nSwitch to using cpuid as the index, as it is guaranteed to be within\nthe valid range provided by for_each_online_cpu()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local platform-driver probe and the local Microchip IPC/IHC interrupt path, not through network packets. A plausible attacker would need local control of the affected platform/IPC peer or firmware configuration to trigger the bad hart/IRQ condition.\nAC:L - The bug is a direct non-contiguous hart ID versus CPU index mismatch with no race or timing requirement. Such hart mappings are plausible for this Microchip RISC-V platform, so triggering does not depend on conditions outside the attacker\u0027s control once the affected path is reachable.\nPR:N - The vulnerable probe and IRQ handler perform no Linux credential, capability, or authentication checks. An attacker able to drive the local IPC peer/firmware-triggered path does not need privileges inside the vulnerable Linux instance.\nUI:N - No victim action is required after the affected platform path is reachable. Probe-time setup or an IPC interrupt can hit the vulnerable access automatically.\nS:U - The corruption occurs in the Linux kernel driver and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary shown.\nC:H - The out-of-bounds index can read adjacent kernel memory/pointer fields and feed invalid buffer addresses into the SBI status path. Conservatively, this kernel OOB access can expose sensitive memory.\nI:H - The vulnerable probe path writes `irq`, `buf_base`, and `buf_base_addr` through an out-of-bounds `cluster_cfg[hartid]` index. This is kernel heap memory corruption and can plausibly be leveraged for control-flow or data integrity compromise.\nA:H - The same out-of-bounds access can corrupt kernel memory or dereference/copy through invalid pointers in interrupt context. A kernel oops, panic, or boot-time failure is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:59.090Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95438699c92947155823dcd3918049a07f3cd867"
        },
        {
          "url": "https://git.kernel.org/stable/c/0442b6229e2eedc95a6d3d18ce75dec7f5b5377c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7c330a8c83c9b0332fd524097eaf3e69148164d"
        }
      ],
      "title": "mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43274",
    "datePublished": "2026-05-06T11:28:57.503Z",
    "dateReserved": "2026-05-01T14:12:55.998Z",
    "dateUpdated": "2026-08-05T12:26:59.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43274",
      "date": "2026-09-21",
      "epss": "0.00131",
      "percentile": "0.03042"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-09T14:38:35.000Z",
      "cve": "CVE-2026-43274",
      "id": "msrc_CVE-2026-43274",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43274.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mailbox-mchp-ipc-sbi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "95438699c92947155823dcd3918049a07f3cd867",
                    "status": "affected",
                    "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0442b6229e2eedc95a6d3d18ce75dec7f5b5377c",
                    "status": "affected",
                    "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7c330a8c83c9b0332fd524097eaf3e69148164d",
                    "status": "affected",
                    "version": "e4b1d67e71419c4af581890ecea84b04920d4116",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mailbox-mchp-ipc-sbi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F818934F-3A6B-46F0-8626-9B45FC127C07",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()\n\nThe cluster_cfg array is dynamically allocated to hold per-CPU\nconfiguration structures, with its size based on the number of online\nCPUs. Previously, this array was indexed using hartid, which may be\nnon-contiguous or exceed the bounds of the array, leading to\nout-of-bounds access.\nSwitch to using cpuid as the index, as it is guaranteed to be within\nthe valid range provided by for_each_online_cpu()."
          }
        ],
        "id": "CVE-2026-43274",
        "lastModified": "2026-06-17T10:49:17.377",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-06T12:16:48.680",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0442b6229e2eedc95a6d3d18ce75dec7f5b5377c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/95438699c92947155823dcd3918049a07f3cd867"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f7c330a8c83c9b0332fd524097eaf3e69148164d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:35:44+00:00",
      "cve": "CVE-2026-43274",
      "id": "CVE-2026-43274",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43274.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:20:38Z",
      "cve": "CVE-2026-43274",
      "id": "CVE-2026-43274",
      "initial_release_date": "2026-05-09T02:39:52Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43274",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43274.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.