Vulnerability-Lookup

GHSA-25MJ-MFQW-XQM2

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-08-09 21:30

Details

In the Linux kernel, the following vulnerability has been resolved:

netconsole: avoid OOB reads, msg is not nul-terminated

msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see:

printk: console [netcon_ext0] enabled
BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240
Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594

CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9
Call Trace:
 kasan_report+0xe4/0x120
 string+0x1f7/0x240
 vsnprintf+0x655/0xba0
 scnprintf+0xba/0x120
 netconsole_write+0x3fe/0xa10
 nbcon_emit_next_record+0x46e/0x860
 nbcon_kthread_func+0x623/0x750

Allocated by task 1:
 nbcon_alloc+0x1ea/0x450
 register_console+0x26b/0xe10
 init_netconsole+0xbb0/0xda0

The buggy address belongs to the object at ffff88813b6d4000
            which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes to the right of
            allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-43197"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:38Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: avoid OOB reads, msg is not nul-terminated\n\nmsg passed to netconsole from the console subsystem is not guaranteed\nto be nul-terminated. Before recent\ncommit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\")\nthe message would be placed in printk_shared_pbufs, a static global\nbuffer, so KASAN had harder time catching OOB accesses. Now we see:\n\n    printk: console [netcon_ext0] enabled\n    BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240\n    Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594\n\n    CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9\n    Call Trace:\n     kasan_report+0xe4/0x120\n     string+0x1f7/0x240\n     vsnprintf+0x655/0xba0\n     scnprintf+0xba/0x120\n     netconsole_write+0x3fe/0xa10\n     nbcon_emit_next_record+0x46e/0x860\n     nbcon_kthread_func+0x623/0x750\n\n    Allocated by task 1:\n     nbcon_alloc+0x1ea/0x450\n     register_console+0x26b/0xe10\n     init_netconsole+0xbb0/0xda0\n\n    The buggy address belongs to the object at ffff88813b6d4000\n                which belongs to the cache kmalloc-4k of size 4096\n    The buggy address is located 0 bytes to the right of\n                allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)",
  "id": "GHSA-25mj-mfqw-xqm2",
  "modified": "2026-08-09T21:30:25Z",
  "published": "2026-05-06T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43197"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-43197 (GCVE-0-2026-43197)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-09 18:34

Title

netconsole: avoid OOB reads, msg is not nul-terminated

Summary

In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/8fe132c4873f9eb1b…
https://git.kernel.org/stable/c/3126a2f98beaec5a5…
https://git.kernel.org/stable/c/74ab1456eaa3b2eb9…
https://git.kernel.org/stable/c/82aec772fca2223bc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c62c0a17f9b7398022f9eebe547878033264f81f , < 8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9 (git) Affected: c62c0a17f9b7398022f9eebe547878033264f81f , < 3126a2f98beaec5a554a1fb31c46db1e8542665e (git) Affected: c62c0a17f9b7398022f9eebe547878033264f81f , < 74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58 (git) Affected: c62c0a17f9b7398022f9eebe547878033264f81f , < 82aec772fca2223bc5774bd9af486fd95766e578 (git)
Linux	Linux	Affected: 6.6 Unaffected: 0 , < 6.6 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/netconsole.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "3126a2f98beaec5a554a1fb31c46db1e8542665e",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "82aec772fca2223bc5774bd9af486fd95766e578",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/netconsole.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: avoid OOB reads, msg is not nul-terminated\n\nmsg passed to netconsole from the console subsystem is not guaranteed\nto be nul-terminated. Before recent\ncommit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\")\nthe message would be placed in printk_shared_pbufs, a static global\nbuffer, so KASAN had harder time catching OOB accesses. Now we see:\n\n    printk: console [netcon_ext0] enabled\n    BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240\n    Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594\n\n    CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9\n    Call Trace:\n     kasan_report+0xe4/0x120\n     string+0x1f7/0x240\n     vsnprintf+0x655/0xba0\n     scnprintf+0xba/0x120\n     netconsole_write+0x3fe/0xa10\n     nbcon_emit_next_record+0x46e/0x860\n     nbcon_kthread_func+0x623/0x750\n\n    Allocated by task 1:\n     nbcon_alloc+0x1ea/0x450\n     register_console+0x26b/0xe10\n     init_netconsole+0xbb0/0xda0\n\n    The buggy address belongs to the object at ffff88813b6d4000\n                which belongs to the cache kmalloc-4k of size 4096\n    The buggy address is located 0 bytes to the right of\n                allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In a reasonable high-impact deployment, an internet-facing firewall/router can have netfilter LOG/nft log rules and extended netconsole with release prepend enabled, so unauthenticated remote packets can create printk records that flow into the vulnerable netconsole path. Netconsole itself sends UDP output rather than receiving commands, but the vulnerable code is reachable through network-triggered kernel logging.\nAC:L - Once the affected netconsole mode is configured and a log record is generated, the `%s` overread is deterministic and requires no race or attacker-uncontrolled timing. The non-fragmented path is easy to hit with ordinary short log messages.\nPR:N - For the network logging scenario, the attacker only sends packets that match an already configured logging rule and needs no account or privileges on the vulnerable host. Netconsole/configfs setup is an environmental prerequisite, not a per-attack privilege requirement.\nUI:N - No victim user action is required after the affected logging configuration is present. The attacker can trigger log generation directly.\nS:U - The vulnerability is in the kernel\u2019s own console/logging path and impacts kernel memory on the same host security authority. It does not cross a VM, IOMMU, or similar separate security boundary.\nC:H - The bug is an out-of-bounds read caused by treating a length-delimited printk buffer as NUL-terminated, allowing reads past the valid message into adjacent printk/slab memory. The leaked bytes can be transmitted in netconsole UDP output and repeated, so confidentiality impact is high.\nI:N - The vulnerable operation is a read-only string scan/copy into the netconsole transmit buffer. I found no out-of-bounds write, object corruption, or control-flow modification primitive.\nA:H - The fix commit shows a KASAN slab-out-of-bounds BUG in this path, and the unbounded `%s` scan can read past the allocation until a NUL byte or fault. Repeated attacker-triggered log messages can therefore reasonably cause kernel oops/panic or severe logging-path disruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T18:34:53.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58"
        },
        {
          "url": "https://git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578"
        }
      ],
      "title": "netconsole: avoid OOB reads, msg is not nul-terminated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43197",
    "datePublished": "2026-05-06T11:28:04.829Z",
    "dateReserved": "2026-05-01T14:12:55.992Z",
    "dateUpdated": "2026-08-09T18:34:53.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.