CVE-2026-43281

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43281
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43281.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-43281
Downstream
Published
2026-05-06T11:29:02.278Z
Modified
2026-05-15T11:53:20.713596139Z
Summary
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
Details

In the Linux kernel, the following vulnerability has been resolved:

mailbox: Prevent out-of-bounds access in fwmboxindex_xlate()

Although it is guided that #mbox-cells must be at least 1, there are many instances of #mbox-cells = <0>; in the device tree. If that is the case and the corresponding mailbox controller does not provide fw_xlate and ofxlatefunction pointers,fwmboxindexxlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43281.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.18.0
Fixed
6.1.167
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.130
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.77
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.16
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43281.json"